Add support for session-backed messages

This allows messages to be stashed in the session and displayed on a
following request. This will be pivotal in implementing the PRG
(post-redirect-get).