From David LeBauer: The user can register with a mixed-case username, but ultimately the username is stored as lowercase (since we're using namespaces). However, when they try to login with the mixed-case name it fails.

We should enforce lower-case logins.