Use username from Mojang for offline IDs

Affected systems: BungeeCord after name change
Effects: Carry on items, permissions, etc. from the old user account without access to the new one

After a name change it could happen that the client still only
knows the old username and will send it to the server. Mojang will provide us with an up-to-date username that we should use instead.

The username is also sent to Mojang, so that they could verify the use. Therefore exploiting this behavior extensively for arbitrary usernames is not possible.

Related #344

core/src/main/java/com/github/games647/fastlogin/core/shared/LoginSession.java

@@ -1,32 +1,42 @@
 package com.github.games647.fastlogin.core.shared;
 
 import com.github.games647.fastlogin.core.StoredProfile;
+import com.google.common.base.Objects;
 
 import java.util.UUID;
 
 public abstract class LoginSession {
 
-    private final String username;
     private final StoredProfile profile;
-    
+
+    private String requestUsername;
+    private String username;
     private UUID uuid;
 
     protected boolean registered;
 
-    public LoginSession(String username, boolean registered, StoredProfile profile) {
-        this.username = username;
+    public LoginSession(String requestUsername, boolean registered, StoredProfile profile) {
+        this.requestUsername = requestUsername;
+        this.username = requestUsername;
+
         this.registered = registered;
         this.profile = profile;
     }
 
+    public String getRequestUsername() {
+        return requestUsername;
+    }
+
     public String getUsername() {
         return username;
     }
 
+    public synchronized void setVerifiedUsername(String username) {
+        this.username = username;
+    }
+
     /**
-     * This value is always false if we authenticate the player with a cracked authentication
-     *
-     * @return
+     * @return This value is always false if we authenticate the player with a cracked authentication
      */
     public synchronized boolean needsRegistration() {
         return !registered;
@@ -56,11 +66,12 @@ public abstract class LoginSession {
 
     @Override
     public synchronized String toString() {
-        return this.getClass().getSimpleName() + '{' +
-                "username='" + username + '\'' +
-                ", profile=" + profile +
-                ", uuid=" + uuid +
-                ", registered=" + registered +
-                '}';
+        return Objects.toStringHelper(this)
+                .add("profile", profile)
+                .add("requestUsername", requestUsername)
+                .add("username", username)
+                .add("uuid", uuid)
+                .add("registered", registered)
+                .toString();
     }
 }