Canonicalize usernames before rate limiting logins