Fix signin from on/* pages

This PR fixes #2427.

My first approach was to make the user name comparison case-insensitive, but there might be platforms where `user_name` is not case-insensitive. So I chose another solution: always taking `user_name` from the same source (the elsewhere info, not the request path), so that it's cased the same way.