Forget about encryption. You are tracking user logins through cookies and the cookies only contain usernames. How much difficult it is for someone to predict someone else's usernames. If you don't encrypt the session information, there is always the threat of someone sniffing the cookie and hijack the session. But in your case I think a user not only can hijack a single session, he can hijack every login session just by changing the username in the cookie. OWASP recommends a session ID of length 128 bits generated through a cryptographically secure Pseudo Random Number Generator (PRNG). Take a look at OWASP session management for further details.
Once you configure the session management according to the OWASP session management guidelines inside your web application code, establish an encrypted tunnel and communicate over the encrypted tunnel. A lot of people use SSL for the login part but as soon as the user is authenticated, communicated reverts back to HTTP. Make sure the cookie is always communicated over the encrypted tunnel as well. If session cookie is in plaintext, a user who sniff the cookie over the network can replay the cookie and gain access to the user account. Firesheep is a tool that demonstrate the exploitation of this vulnerability through a single click.