Why does success only call commitSession if we are doing a redirect?

[vedantroy]

Hi! Thanks for making this great library. I'm reading through the source code to understand the internals. Here's my current understanding of the flow:

• User logs in / submits credential info
• On the server, authenticate calls verify which is supplied by the developer. verify will do the actual authentication logic & then return the session data
• if verify succeeds, authenticate will call success

Now, my assumption is that success should serialize the new session data to

1. The underlying session store
2. Return the new cookie

But it seems like if there's no redirect then success will not serialize anything. Doesn't this mean that if we don't do a redirect, the user will not actually be logged in because we never serialized the updated cookie to their browser / their session data to redis/disk/etc.?

Another question: What is the purpose of "flashing" in a session?