Check that username isn't taken
Get files_hmac from /hmac instead of deriving from password (which might change)