Verify the token passed to us.

Ooops, I was blindly accepting the token contents and hoping it matched what we have in the DB.  This doesn't make the cookie token completely hack proof, but a little verification should make things a little more secure, I hope.

Removed the username from the cookie too to make it a little harder to associated with a particular user.