hsession username sets cookie
hsession release