Wouldn't hurt to put a comment here, saying why we redirect when username is not set.