Allow anti-forgery :error-handler to set flash

See issue #7.