Normalize usernames for signups through OAuth

This ensures, for example, new users don't get created with uppercase usernames
that later cause issues when we automatically redirect to lowercase equivalents,
resulting in 404s.

It also adds an author.IsValidUsername check when registering via OAuth.

Note: this does _not_ automatically fix current users who might've ended up
with a faulty username.

This fixes #648 #844