fix security issue of username unique check