phase 9: check login credentials and decide further user direction (php header, ob_start(), ob_flush())