Add username to signed json, remove uniqueness on walletID

This PR closes the "collide with walletID to verify a password" threat.  It does this by introducing the username into any situation where we get a wallet by walletID, most notably when we lookup the publicKey for a wallet to verify a signed request.

By removing the uniqueness constraint on `walletID`  we now are not vulnerable to an attacker repeatedly creating dummy wallets with an online dictionary attack that determines success by colliding with walletID.