moved session initialization to index.php