Perhaps `HudsonPrivateSecurityRealm` should use `CaseSensitive` to begin with? It is not interacting with an external system so there is no reason to conflate case.

(Existing user records would I guess be stored under the lowercase filenames, so after the upgrade you would need to log in with a lowercase user ID.)