take SAML username from REMOTE_USER, but ignore _everyone