add username == null check, throw IAE if username == null