switch to using the username. We may do a double lookup for now, but it makes the service layer responsible for transactions rather than the control for this piece of code.