There was an inconsistency in the case of the authentication name. You were logging in as "user" but validating that the login was done for "User".
I updated the _panel_head and _panel_foot pages to use the "user" validation and it works properly now.