Improve the security of SESSION variables

Question

I have some doubt. This script is supposed to be protected from public access via an authentication method. Do you think that it's doing its work properly? Is it safe to do so? What do you think is missing or should be added? Thank you for helping me.

session_start();

if(!isset($_SESSION['USER'])) {
    header('Location: /login.php');
    return false;
}

header('Content-Type: text/html');
readfile('/path/to/protected/data');