Halfway down you're having
session_start();
But you don't want any output before that. And you have -in the very least- this allready sent:
<h3>Login</h3>
<form action="" method="post">
Username<br/>
<input name="username" type="text" /><br/>
Password<br/>
<input name="password" type="password" /><br/>
<input name="" type="submit" /><br/>
</form>
PUt the session on the top :D