handle username consistently

line 77, `(get form-params "username" "")` is inconsistent with above manner of retrieving username. Also, it breaks compatibility with previous version if someone is using the `wrap-keyword-params` middleware