direct use User because of SkipIfCustomUser decorator
don't repeat username in user form
let admin-compliant CustomUser reuse auth.form