fix async bugs; add dotenv

close #17 (flash messages)
close #18 (admin page race issue)