If you include sample pages I can see what you did wrong.
In terms of having two redirects you may what to apply the login server behavior twice and include a column filter for the user type column where you store whether they are candidates or companies.
Just apply it twice and don't include a failure redirect in the first one, but have a success redirect in both.
The logout server behavior should include the session_start code automatically. You only have to manually add it when referring to session variables from another server behavior on the page. All of the user authentication server behaviors should start the session automatically.