moved the session_start() to a more preferable place