ok, I tried both URLs. The accessdenied.php file does not exist off the webroot. Check your URL there. The login.php does work (no 404) but I noticed a flaw in your logic:
if(isset($_POST['uid']))
{
$uid = $_POST['uid'];
}
else
{
$_SESSION['uid'];
}
Here, in the else block, that will do nothing. I think you meant:
if(isset($_POST['uid']))
{
$uid = $_POST['uid'];
}
else
{
$uid = $_SESSION['uid'];
}
Also, you might want to know that to destroy session variables, you must call session_unregister() not unset() on the $_SESSION array.
Hope this helps,
Mike