Fix security hole. Always take githubUsername from
session.