The functions that generate, validate and clear auth cookies are all pluggable (meaning you can write your own versions of them). Just note that some of them may need to return something specific (like the user ID).
- wp_generate_auth_cookie() (generates your cookies)
- wp_set_auth_cookie (actually sets the cookies)
- wp_validate_auth_cookie() (validates your cookies)
- wp_parse_auth_cookie (parses an auth cookie, breaking it up
into its component parts) - wp_clear_auth_cookie (clear the auth cookies on logout)
One note: the cookies should, in fact, be destroyed when you log out. If they’re not being destroyed, something is probably wrong. And “User session cookies are not secure” is pretty vague–you should ask for more input before you can conceptualize how to resolve this.
To solve your “session cookie includes username” problem, you could encrypt/obfuscate the value somehow before setting it, and decrypt it before running it through the auth check.