Here are the code of my login page where the login script checks for the authenticity of the user and then redirects to inbox page using header function.
<
I had similar issue and with the cookie domain:
ini_set('session.cookie_domain', '.domain.com');
the domain was setup wrong so all sessions were ignored because the user cookie was never set right hope this will help someone.