Lazy-load username blacklist

By lazy loading the blacklist applications can include the h package
and subsequently use the `config.override_assets` API to change the
blacklist file before the first request.