Gracefully handle cookie referring to unknown user

This can happen if we clear the database, but users still
have cookies that refer to a mongo _id.