cookie-based authentication: load username from cookie