Hi all, I've added 2 tasks to add to this PR:

• Validate that gaiaURL is present if username is present. Suggestion from @friedger
• Include validateUsername on all models, unless it has a userGroupId (to preserve group privacy). This is in line with the spec.

One issue that @leopradel brought up was that this doesn't work well for brand-new Blockstack users. If they just registered a name, and it hasn't propagated yet, then how can we validate the username?

One option is to accept User model registrations if they're using a Blockstack ID that does not exist. If it does exist, we'll do the same validation that we do here.

Include validateUsername on all models

There is more talks about blockstack ids without username. Whether a username is required should be a validation done on the client of the radiks server, shouldn't ?

If they just registered a name, and it hasn't propagated yet, then how can we validate the username?

Same holds for invalid usernames that were never registered.
Ideally, models that contain the username (and needs to be verified) are signed with the private key of the username. As long as there is no way to verify that the current user owns the key of the username models shouldn't verify the models.

I suggest that the server removes username from the unverifiable model and stores the value in usernameUnverified or so.