Is FLASHDATA visible to user?

[eluser]WanWizard[/eluser]
As you use the database to store your session data, no data is send to the client.

But by not encrypting the session cookie, you've opened yourself to session hijacking, so don't switch that off.