Don't sign assertions for invalid usernames