using username instead of name. get it from security context.