wrote tests for GET /api/user/:username