Temporary fix for GDPR-compliant user search

Init payload iwth both username and query

`query` is a different parameter from `username` so it shouldn't replace
it actually. Tested with v3 API and it's working.