Only initialize $_SESSION if it hasn't already been initialized.
Store fresh_install in the session upon install, show messages until password is set.