[fix] disallow falsy or empty usernames to prevent undefined users