escape and trim usernames *before* checks