remove session_start()

the login form already starts a session