security bugfix: assert uid<->name mapping

here's the current setup.  The server establishes the mapping in the first
lookup, and then it's iced into place. We check that all tracking statements
and all signed signature by the user keep the uid<->name mapping, and if not,
then it's a fatal-ish error.

in other words, the mapping should never change, and we start now
to enforce that...