$username is overwritten by $_GET variables if user specifies username= in
the URL. Move to so taht it resets it to the session variable.