GET /api/users/:username should require auth