Fix for #15 "Warning can never be triggered"

move authVals.username to after the check for authVals === null