username can be empty, meaning anybody, or must match literally.
only db and host names are matched with wildcards.