moving session start from Ivan's branch so that we aren't auto logged out on every page load (the session has to be started before we can check for session variables)