HTTP server: use cookie to remember the logout state
ACL: Fix username match