Drastically simplified by using DACS_USERNAME - plus, mod_auth_dacs
stripped the cookie off, so we couldn't get to it.