login_from_cookie should always return the user object (or nil)