Remove wrap-username by relying on friend's ability to produce current-authentication without a request.