Php et page protégée par mdp

<?php
session_start();

if( isset($_POST['pass']) && isset($_POST['username']) ){
        $pass = $_POST['pass'];
        $user = $_POST['username'];
             if( ($pass == 'tonmotdepass') && ($user == 'username') ){
                    $_SESSION['accesrestreint'] = 1;
                     echo '<meta http-equiv="refresh" content="0;url=pageprotege.php">';
             }
             else{
                      echo 'pass/user incorrect';
             }
}
else{
}
?>

<form action="#" method="POST">
      Pseudo :           <input type="text" name="username"> <br>
      Mot de passe :   <input type="password" name="pass">
</form>

<?php
session_start();
if(  $_SESSION['accesrestreint'] == 1 ){
?>
contenu de la page protégé
<?php
}
else{
<meta http-equiv="refresh" content="0;url=home.php">
}
?>

<form action="#" method="POST">
      Pseudo :           <input type="text" name="username"> <br>
      Mot de passe :   <input type="password" name="pass">
</form>

<form action="#" method="POST">
      Pseudo :           <input type="text" name="username"> <br>
      Mot de passe :   <input type="password" name="pass"> <br>
                              <input type="submit" value="Accéder à l'espace restreint">
</form>