If the username must be lowercase, why does the CGI insist you retype a string with uppercase? Shouldn't it simply lc($username) and validate?
To that effect does it really need to advertise, both on the login and registration, the case of the username at all. Can't it handle usernames as case insensitive?