fixed bug caused by renaming of locals.user as locals.currentUser in the form handling.  also found that naming of client cookie was inconsistent