ensure stored username is a string

Turns out sometimes the username is a number, maybe. At least it's something that doesn't have a `toLowerCase()` method.