server: dont inject user from cookie, or if from Kik

quick bit on the security reasons. eg 
`# since we use http, we don't want to inject sensitive information into the page`