Since `User#to_param` already returns `User#username`, we don't need to
pass in the user's username. Changing this also helps us obey LoD.