Everything now counts with the username, that is generated by the UsernameGenerator - there's no hidden magic anymore.

This has implications in success handlers, as they need to take different UPN vs different pre-2000 username into account. Misconfigured LDAP all the way, bitchez!