This is a bit crap. Maybe it's better to solve this with 'roles' or add a property to wallposts like permissions = ['read'] or permissions = ['read', 'update', 'delete'].
Thus the API takes control on permissions. Of course we going to check permissions in the API anyway, but this username check doesn't seem the right solution.