extract common session cookie manipulation
rewrite cookie getter
normalize user id of oauth user
keep user id (Parse's objectId) in cookie
keep objectId rather than username in manager
add acl util