Update api and corresponding models

What happens if username == requested by? Looks like this falls through.