server: dont inject user from cookie, or if from Kik

Yes, see L107 (useragent middleware)