The "NOTE: username is case-sensitive" comment is likely to confuse deployers more than help in that they might think it applies to all authentication handlers.   Let's just make the default username lower case, and let it be.