- Resolve submitted username to user id via LoginAttemptService.resolveKey
- /unlock and /loginInfo now take/return userId instead of username
- Fall back to submitted username for unknown users