server: dont inject user from cookie, or if from Kik

is this an express thing?