change `username` to `scope` to reflect that this validation is used for all scopes, including users and orgs