Add them to the link URL(s) in the standard &Variable_Name=Value format.
Mm, tried that, it didn't work. With &username=<%=$User->{username}%> in the link, the username I am logged in as shows up in the URL at the top of the popup window pane, but still the <%=$User->{username}%> code in the popup template itself shows up as "anonymous". If I configure the target calender to require login, the login screen shows up in the popup, even if I am logged in as Administrator (or anything else).
It's very odd. And, I could have sworn it was working last week. The only thing I did to change things was add a couple of calendars to the metacalendar, and imported the data for them using FTP (I had them using another copy of calendarscript elsewhere on the server). But I've deleted those calendars and it's behaving the same way.