session_start() moved to header.php