Ensure forms can't be tampered with by providing no username

* required making sure user_lookup_field is defaulted
* update find method