use user_id rather than user_login in the authentication cookie

[Denis-de-Bernardy]

suggested enhancement:

• prevent username from matching /d+/
• use user_id, instead of user_login, in the authentication cookie

this one might be worth a discussion in wp-hackers. it is meant to prevent the username to be passed in the cookie.

it *might* break a plugin or two that relies on the auth_cookie_bad_username hook. we could alternatively keep that hook's name unchanged, but the semantics would wrong. or we could fire both auth_cookie_bad_username *and* auth_cookie_bad_user_id, passing the user_id each time -- to ensure 100% backwards compat.

I think we went with username instead of ID in the cookie because we expose usernames in so many other places that isn't really very private.

Sounds reasonable. It *could* be an issue when the username is an email, though. ;-)

see also: #9568

refreshed against 11256

Since you took care of the email case in your other patch, I'd like to say wontfix on this one.

actually, the user_nicename and the cookie are separate issues.

the cookie currently contains the user_login, rather than the user_nicename. I could change the patch to use the user_nicename if you think it's preferrable.

still applies clean, but delaying this until we get the log in using email address thingy done. else, it makes no sense to get this into WP.

closing this, based on westi's suggestion in the #9568