SecurityTestCase: fix username / user_id confusion

Theses methods have always been using user_id, but where written at
a time where there was not such disctinction