Adding username

So the API has a username parameter, which could be handy if you are concurrently logged in a couple of ways, or you didn't want to have a particular user identity leaked.  Or just for a general control channel when generating an assertion.

However, we don't have a way to pass this information down to the IdP.  That presents a problem: "message" is defined to be the blob that contains the fingerprints.  We can't use that for two reasons: it's supposed to be opaque (it's for browser to talk to other browser), and we don't really want this information being carried in the assertion.

Two options seem fairly obvious:
1. bump the opaque blob down another level:
```json
{
  "type": "SIGN", "id": "12", "origin": "https://example.org",
  "message": {
    "content": "...the binary blob...",
    "username": "user@example.com"
  }
}
```
2. Add some more parameters at the next level up:
```json
{
  "type": "SIGN", "id": "12", "origin": "https://example.org",
  "message": "...the binary blob...",
  "username": "user@example.com"
}
```
The latter looks marginally better to the IdP, so I've included that one.