using 'user' from cookie for the time being #22