Oh wait, I just see 2 errors you have.
You are doing no checking here
if ($username && $password)
if you are checking to see if a person entered the information, is should be:
if (!empty($username) && !empty($password)) {
and when you do a comparison, you must have 2 ==
Currently:
if($true = $passcode)
Suppose to be:
if($true == $passcode)
Your session_start should always initiate when using a login system after verifiying that a person has entered the information and not at the very start of the page. You do not want a person to be retaining and information is they are not authorized.
Only time you want your session_start() to be in the very top is when you have HTML code mixed in your function.