replayshell.cc: get real username in more-secure fashion