Added an ArgumentNullException sanity check to let devs know it’s not allowed here, and checked before calling the method. The standard validation pipeline does the rest as it is marked [Required]

src/Orchard.Web/Modules/Orchard.Users/Services/MembershipService.cs

@@ -44,6 +44,9 @@ namespace Orchard.Users.Services {
         }
 
         public IUser GetUser(string username) {
+            if(username == null) {
+                throw new ArgumentNullException("username");
+            }
             var userRecord = _userRepository.Get(x => x.NormalizedUserName == username.ToLower());
             if (userRecord == null) {
                 return null;