Allow access to usernames in JSON:API via permissions, rather than implicitly allowing it.
Closes #3240913