This related to bug #7877, which was said not to be a bug, and that you must session_start() before any html gets sent so that the cookie gets sent before the html header.  Otherwise, calling session_start() gives the error messages stated in #7877.

At least in 4.0.2, I have found that you cannot even have so much as one blank line in your php file before your <?php tag, or else the initial header gets sent and start_session() fails.  You MUST have <?php as the absolute very first bytes of your file.

This should either be fixed, or at least well documented.  The docs don't say anything about the importance of start_session() being called immediately, nor do they say anywhere that if you have any blank lines before your <?php tag that it will then be too late to start a session.