use hmac and update flash messages