auth bugfix: username