On your home page, your not checking your session variables to see if you are already logged in.
And once you have logged in, there will be values stored in your session variables.
So as long as you keep the session open, when you go back to the page where you are supposed to go after logging in, you will still be logged in until you end the session.
Generally, once you close the browser, the current session will end.
You can secure your session variables if you unset them after you login.
But then you will have to login every time you go back to the home page.
Also if you unset the session variables after you login, and then refresh the page, you will no longer be logged in.
You might want to read this article:
Notes on PHP Session Security