cookie usernames used, only hardcoded emails in routes