Warn about unknown `hasher` in `verify_password`
Define `GTW.RST.Request.username` as `property`

Instead of as `Once_Property`:

* `GTW.RST.Request.username` was defined as `Once_Property`, but
  `GTW.RST.TOP.Request.username` can be changed.

* This worked until yesterday I changed `GTW.RST.TOP.Request.username` to
  chain up to `GTW.RST.Request.username`; the super-call let all hell
  break lose because it resulted in a call to
  `GTW.RST.Request.username.setter` by the `Once_Property` wich broke the
  session.

* Now `_auth_user_name` is a `Once_Property` (to allow caching during the
  lifetime of the request), but `username` is just a property.