username is 'required' (there are still some loopholes)