After applying Fraida's patch - thank you - I got inspired to clean up the whole handling of session state. Turns out that there was still plenty of old session code floating around which is now taken care of by SessionAuthenticator in omf_web. Now the login name even shows up in the top right corner.