YOURLS stores credentials (hashed login / password) in a uniquely named cookie, something like yourls_75715761fe7da[...]199e566c53f27eeb, see yourls_store_cookie().

Yet, if two cookies named username and password are present, it makes logging in impossible

Most likely this is because we're loosely checking $_REQUEST (here for instance) which can contain $_GET, $_POST... and $_COOKIE.

$_REQUEST is thoroughly used across YOURLS, maybe we should introduce a function to fetch $_GET or $_POST but not those darn cookies.

Possible references: #3382, #3087, #3351