the username should be in the request.use.username