fewer direct env manipulations

this commit removes some direct access to `env`.

actionpack/lib/action_controller/metal/request_forgery_protection.rb

@@ -137,7 +137,7 @@ def initialize(controller)
         def handle_unverified_request
           request = @controller.request
           request.session = NullSessionHash.new(request)
-          request.env['action_dispatch.request.flash_hash'] = nil
+          request.flash = nil
           request.env['rack.session.options'] = { skip: true }
           request.cookie_jar = NullCookieJar.build(request, {})
         end

actionpack/lib/action_dispatch/http/request.rb

@@ -324,7 +324,7 @@ def reset_session
       else
         self.session = {}
       end
-      set_header('action_dispatch.request.flash_hash', nil)
+      self.flash = nil
     end
 
     def session=(session) #:nodoc: