httpOnly for cookies
test user's name for dropdown