Exactly. Any proper implementation of this kind of security should not depend on the username, this would entirely break the purpose.