There are built-in session context for things like the HTTP request.

This gets the remote user:

<user>
<s:getxml xmlns:s="http://apache.org/cocoon/session/1.0" context="request" path=
"/remoteUser"/>
</user>

Check out the Cocoon documentation on the Session transformer.