In my opinion, there is one serious omission to Flask at the moment and that is that there is no authoritative method for authorizing users.
In a way this goes with the general ethos of micro frameworks - it isn't being forced down your throat unless you want it.
However in this case I think that at least some structured 'recipes' are required to provide peer guidance, best practice or whatever you want to call it. Too often the advice is "roll your own", but I'm not sure I'd be comfortable recommending that to the inexperienced.