Hints : British Biscuit = Cookie.

I try username=admin & password=admin, login success but it gives me that this is a limited user. Let check cookie:
r - 351e766803d63c7ede8cb1e1c8db5e51c63fd47cff
u - 351e76680321232f297a57a5a743894a0e4a801fc3

we have similar string in both cookie : "351e766803". Put it away we will have a md5 string
r - d63c7ede8cb1e1c8db5e51c63fd47cff = limited

u - 21232f297a57a5a743894a0e4a801fc3 = admin

Change the cookie value r into md5(admin) and yup :
Congratulations! The flag is: bb6df1e39bd297a47ed0eeaea9cac7ee