server: dont inject user from cookie, or if from Kik