header('Cache-control: private, must-revalidate'); session_cache_limiter('private, must-revalidate');
一定要在session_start()前
