Looks good, will finish reviewing and merge this weekend. I don't think there was a major concern with calling session_start() blindly or twice (other than an E_NOTICE error), but your fix appears to be a more standard pattern which couldn't hurt to implement. I'll also need to check if session_start() is actually being called twice and throwing an error somewhere, since I'm curious about that now.

Some refs:

http://stackoverflow.com/questions/2580322/is-there-any-harm-in-running-session-start-multiple-times-as-the-page-request

http://php.net/manual/en/function.session-status.php

Yup, just trying to quiet my logs. Thanks!

Good point on checking whether this is called elsewhere in this plugin. I grepped my wp-content directory and didn't find many other possibilities, so it may well be this plugin trying to start the session multiple times.

Would be great if you could merge this in and release it, lots of php notices are being thrown by this plugin when WP_DEBUG is on. This pull request fixes a big one that is on the main login form (wp-login.php).