不允许发布访问权限（会话）

Question

Hi I'm currently trying build a login using angular 6 with web api of php. I am trying to the message when a particular account with a specific role logs in. However, the only the post message is appearing from the session.php, but the message saying i am logged in appears in the auth.php. How should i go about fixing this?

auth.php:

<?php
session_start();
require 'connection.php';
$_POST = json_decode(file_get_contents('php://input'), true);
if(isset($_POST) && !empty($_POST)){
    $username = $_POST['username'];
    $password = $_POST['password'];
    $hashed = md5($password);


    $stmt=$con->prepare("SELECT * FROM user WHERE username= :u AND password=:p");
    $stmt->execute(array(':u' => $username, ':p' => $hashed));
    // $row = $stmt->fetchColumn();
    $row = $stmt->fetchColumn();

    //user is logged in
    if ($row >= 1 ) {

        $row2 = $stmt->fetch(PDO::FETCH_ASSOC); 
        if($row2['role']== 0){
            // buat session login dan username
            $_SESSION['username'] = $username;
            $_SESSION['role'] = "Admin";
        }else{
            $_SESSION['username'] = $username;
            $_SESSION['role'] = "Tenant";
        }

        ?>
        {
            "success": true,
            "secret": "You are logged in"

        }
        <?php

    }else{
        ?>
        {
            "success": false,
            "message": "Invalid Credentials"
        }
        <?php
    }
}else{

    ?>
    {
        "success": false,
        "message": "Only POSt access accepted"
    }
    <?php
}
?>

session.php:

<?php
session_start();
require 'connection.php';
if(isset($_SESSION['role'])){
        $role = $_SESSION['role'];


        if($role == "Admin"){
        ?>
            {
                "message": "You are logged in as an adminstrator",
                "success": true
            }
        <?php

        }elseif($role == "Tenant"){
        ?>
            {
                "message": "You are logged in as a tenant",
                "success": true
            }
          <?php
        }else{
        ?>
            {
                "message": "You are not authorized",
                "success": true
            }
        <?php
        }
}else{
     ?>
            {
                "message": "Only post",
                "success": true
            }
          <?php
}
    ?>

user.service.ts:

import { Injectable } from '@angular/core';
import { HttpClient } from '@angular/common/http';

interface myData{
  message: string,
  success: boolean
}

@Injectable({
  providedIn: 'root'
})
export class UserService {
  public url = 'http://localhost/api/';
  constructor(private http: HttpClient) { }

  getSomeData(){
    return this.http.get<myData>(this.url + 'session.php')
  }
}

admin.component.ts:

import { Component, OnInit } from '@angular/core';
import { UserService } from '../user.service';

@Component({
  selector: 'app-admin',
  templateUrl: './admin.component.html',
  styleUrls: ['./admin.component.css']
})
export class AdminComponent implements OnInit {

  message = "Loading..."
  constructor(private user: UserService) { }

  ngOnInit() {
    this.user.getSomeData().subscribe(data => {
      this.message = data.message
    })
  }

}