converted /api/check-username to use db.query