refreshing cookie needs username