As noted on bug 40275, check_cookie_auth() could replace its userid/cardnumber lookups using Koha::Patrons->find_by_identifier but it seems like it would be better to actually have it use borrowernumber instead.