The way `webmaker-auth` and `webmaker-auth-client` are formatting the request, this should be `req.body.user.username`