use HTTP_REMOTE_USER if present (like nginx)
version 1.6.3