In addition to what has been mentioned already.

##DB connection##

I would suggest to define a charset in your PDO connection string, as good practice.

There are some rare border cases where PDO prepared statements are still prone to SQL injections, Ircmaxell explains this better than I can in his posthis post.

$this->conn = new PDO("mysql:host=" . $this->host . ";dbname=" . $this->db_name .';charset=latin1;', $this->username, $this->password);

##Sessions##

To make it harder for Sessions to be hijacked you should regenerate your session id after login with session_regenerate_id();.

Also configuring PHP to keep your cookies safe will secure your login further.

Enabling session.cookie_httponly will prevent your cookies from being accessed by scripting languages and enabling session.cookie_secure will ensure that are cookies being send over HTTPS (Which I assume you will be using). Please look up the PHP manual for more information about these settings.

Also when the user log out, you can use session_destroy() to destroy all data registered to a session.

Output

Your form is currently not protected against CRSF, I suggest searching for a library or alternatively read this script on OWASP.

Currently your validation will throw an error as your uname, uname and upass variables are not being checked if they exist, I would tighten your validation, as an example:

if(isset($_POST['btn-signup'])) {    
   if( empty($_POST['txt_uname']) || !is_string($_POST['txt_uname']) )  {
      $error[] = "Provide username!";   
        }
    else if( empty($_POST['txt_umail']) ) {
      $error[] = "Provide email!";  
        }
    else if(!filter_var($_POST['txt_umail'], FILTER_VALIDATE_EMAIL)) {
      $error[] = 'Please enter a valid email address!';
     } 
    else if( empty($_POST['txt_upass']) ) {
      $error[] = "Provide password!";
    }
    else if(strlen($_POST['txt_pass']) < 6){
      $error[] = "Password must be atleast 6 characters!";  
    } else {
      // etc.
   }
}

In addition you can add a honey pot input field in your form to detect if the registration is spam. If this hidden input field has been filled in then you should not register the user as this is most likely spam.