Of course your session variables aren't getting registered, you're not telling php to do it. PHP is pretty cool, but like kamy99 (and myself), it is not a magician. Tell it to register your session vars.
session_start();
session_register('username');
session_register('password');
I suggest reading this page: Session info @ php.net. Important function to read about there are session_destroy(), session_register(), session_start(), session_unregister, and session_unset. If you're going to be working with sessions you really need a strong understanding of these functions.