Allow anti-forgery :error-handler to set flash

closes #7