call session_start() before any HTML, to avoid PHP5.3 warnings