OP set request ATTR_USERNAME even if whitelisted or skipPath