username validation is case-insensitive