The credentials callback may be passed a username in case where
the URL already includes the expected username. As we usually
cannot use a different username in such context, we should use
that one if provided and not ask the user for a diferent
username.