Simplified WebauthUser (OneToOneField, not ManyToManyField; username,
not webauth_username).