Use normalized username, not escaped