This will fail if the user does not have a `username`, which is the case for all old logins. Use `userid` instead of `username` here.