MDL-29938 don't validate return user info against PARAM_USERNAME as PARAM_USERNAME only apply to manual authentication (and web service)