moved session_start to inside the html tag
sha1 passwords are 40 characters long :P
login works now