db: usernames must be unique now

- the old version accepted duplicate user names with no way to authenticate
- new version demands usernames to be unique