adding login-session, using flash.now to ensure flash message isn't persistent