Move $theme reset (avoids theme cookie exploit) to top, before config.php is loaded...