handle empty cache path
also do not use config options within the class
SECURITY: fix username_trusted handling
Also fail if username is empty (nicer exit msg)