make `change_username` return the string used

The benefit being that in the case where we strip characters from the
requested username, we can return the new actual username without
hitting the database again.