removed HTTP_REMOTE_USER