usernames are saved as lowercase and validated for uniqueness