fix the security audit rule of no username in session cookie