I'm not sure if it's a problem that I have session_start(); in two places—in index.php and login.php. If I remove it from one of these files, logging in on the site doesn't work, so I guess it has to stay.