Always convert usernames to lowercase in form input

server/login.go

@@ -199,7 +199,8 @@ func (l *loginHandler) dispatch(w http.ResponseWriter, req *http.Request, sessio
 
 // Handle password-based login.
 func (l *loginHandler) handlePassword(w http.ResponseWriter, req *http.Request, session *loginSession) (loginState, []byte, error) {
-	username := req.FormValue("username")
+	// Case-fold usernames to lowercase.
+	username := strings.ToLower(req.FormValue("username"))
 	password := req.FormValue("password")
 
 	// If the request is a POST, attempt login with username/password.