Add UserProvider

- Create CookieBaker from HttpHeaders instead of HttpServletRequest