Inject user

because it guarantees that the cookie is set
but I'll remove it, because document.cookie probably won't ever fail