You ask what is happening - and I can't tell you that without seeing your code. Here is what I would expect to happen.
Your home page (index.php) may include a form containing the username, and password fields, and a button to submit the form. Index.php may contain only the logon screen, or the form may be a small option on the side.
a) The user enters his username and password and clicks the login button. The data is then POSTed to the server, to the URL set up in the form tag.
b) This php script, validates the username and password (being careful to encrypt the password
before looking for the user's record in the database, so the password is not stored in plain text).
c) If the user and password is acceptable, session variables are stored, and a "start" screen is generated. If not the log-on screen is generated again, with an error message (that does not admit which is wrong).
d) As the code exists, the session is saved and the generated screen is sent to the browser (automatically).
e) All pages that must be protected by the login, must execute session_start() and present the login screen if the logged_in flag is not set. An easy way to do this is to redirect to the home page.
Do not use AJAX to handle the login screen, because you need to show a different screen if the validation fails to when it succeeds. AJAX would mean that you would have to have already sent the passord protected screen to the user before he logs in, and that is a bad idea. For login, AJAX gains you nothing.
Where AJAX is helpful is when you need to send data to the server for storage, in case the client crashes. AJAX is also useful when the client needs some extra data following some user input. For example, in a checkout, the user enters his country, and the page then fetches the postage costs using AJAX.
