Adding REMOTE_USER.

It's 2013. I think we can ignore REMOTE_IDENT from the CGI spec. :)