Ensure usernames are treated as case-insensitive during registration checks

This resolves a vulnerability in which a user could effectively shadow
another user's account by creating an account with the login name
consisting of the same characters as the original account's, except in
different case. (e.g. PARSIFAL could shadow Parsifal)