Figured out why security was commented out:

In the absence of session_start() no session_user_id was defined which
produced false for $sec->isLoggedIn();

members/add.php

@@ -1,4 +1,4 @@
-<?php
+<?php session_start();
 
 include ("../settings.php");
 include ("../language/$cfg_language");

members/getinfo.php

@@ -1,4 +1,4 @@
-<?php
+<?php session_start();
 
 include ("../settings.php");
 include ("../language/$cfg_language");

members/signinsubmit.php

@@ -1,4 +1,4 @@
-<?php
+<?php session_start();
 
 include ("../settings.php");
 include ("../language/$cfg_language");

members/signinsubmitretro.php

@@ -7,7 +7,7 @@
 
 
 
-<?php
+<?php  session_start();
 
 include ("../settings.php");
 include ("../language/$cfg_language");

members/submit.php

@@ -1,4 +1,4 @@
-<?php
+<?php session_start();
 
 include ("../settings.php");
 include ("../language/$cfg_language");