bugfix - moved session_init() to prevent accidental login