Possible fix for incorrect token

It appears that sometimes the first time you open the page,
the token is not synced correctly or something, causing
the CSRF check to fail. Starting the session before any
HTML is outputted seems to be a recommended first step to
troubleshooting PHP session errors. I have tried to test
this fix, but right now I don't know exactly what triggers
the error.

list.php

@@ -1,4 +1,5 @@
 <?php
+session_start();
 require "header.html";
 
 $list = $_GET['l'];
@@ -12,7 +13,6 @@ function getFullName() {
 }
 
 // Generate CSRF token
-session_start();
 if(empty($_SESSION['token'])) {
     $_SESSION['token'] = base64_encode(openssl_random_pseudo_bytes(32));
 }