$_SESSION gets defined after `session_start()` is called. The thing is...  it seems on newer PHP versions $_SESSION is defined even before `session_start()`.