Backend query for username fetch

[pl98]

The users collection should be private and not accessible from the frontend. Therefore any fetches of a player's username should be performed on the backend.