Flash fails in nonobvious way when secret isn't set

[cgrinds]

Here's what fails http://paste.pocoo.org/show/202792/

The Flash section of the docs should at least mention that app.secret is required but I'm not sure that's enough.

One idea would be to require secret_key to be explicitly set and fail to run if it isn't.
For folks that don't need sessions they could pass a message to that effect to run().
My guess is session/flash will be used by more apps than not.

[mitsuhiko]

Session falls back to a dummy object now if secret_key is missing.

This makes it possible to still read-only access the empty session but
requires the secret key to be set for write access. The error message
raised explains that. This closed by 5310fc3.