fixed logic to avoid hitting DB with bad username