Add username to request
Boolean implementation should return request

It shouldn't be returning true, as per the HttpRequestAuthorizer
protocol semantics.