Move username_allowed, write basic test

This moves username_allowed from passwords to forms which seems better.
It also adds a basic test that we can flesh out at some point to make
sure things are kosher.

r?