Clean up to sessions.

Do not session_regenerate_id every page load.

Always end the script after a Location:, so the rest of the page is not
generated or sent before we are given a new page anyway.

If the user lookup failed (the logged-in user is not of that type or the
session is invalid), then redirect to index.php.