ensure session_start() is only called once