move session_start to auth.php