Usernames should be unique, despite case.
Note that you need some authentication module.
Fix test and authentication checking in the case where no session and no token is supplied.