let's add just a bit more logging since this is still not working
fix the security audit rule of no username in session cookie