The cookie should not contain something computable at all. It should be some kind of session identifier, generated by your code when user:pass combo checks out.

And if possible, store the session information somewhere else than your database. Redis and Memcached is a nice fit for stuff like that.