cleanup: avoid php warning when accessing $_SESSION['username']
cleanup: throw error if query fails
auth: allow config.php to set username
cleanup: avoid another php warning