API checkAvailibility security

allow lookup only on username, name or email.