Dereference user_name once
Here's a failing test for #2978
Validate elsewhere username in failure page
Acknowledge benhc123 on security page
Validate elsewhere username locally (vs. remotely)
Don't crash in absence of rate-limit headers
Merge pull request #2982 from gratipay/tighten-up-elsewhere-failure-page

tighten up elsewhere failure page