removed session_start()