if $common_name is empty, use $username (user supplied instead of cert-enforced)
Note: openvpn or prior scripts have to validate the username during authentication.
The openvpn-netfilter script will not validate the username, it accepts anything that is given and assumes the user is
properly authenticated.