username optional at change-auth controller-API (#221)