signin.php:
In place of
<li><a href="signin.php">Sign in</a></li>
you need
<li>
<?php
if(isset($_SESSION['username'])) { ?>
<a href="signout.php">Sign out</a>
<?php
} else { ?>
<a href="signin.php">Sign in</a>
<?php
} ?>
</li>
You have massive security issues there. You're storing passwords in plain text in your database, by the looks of it. You need to fix this. Now.