Find user by params[:id], not :username - params[:username] could be the *new* username value.