Make userid unique for usercredentials

This will force the user to only have one "secret" and not have a second
option for authentication