Update User.php

$this->username was used instead of $username, this breaks the query.