usernameMatchesField should allow creation of new documents

[natevw]

When oldDoc is null, the usernameMatchesField always rejects the document — this makes it a hassle to use, as it requires breaking out the create action to use a different validator.

[natevw]

To clarify, right now to use permissions.usernameMatchesField you must explicitly combine broken-out permissions with fields.creator() on the field itself for the initial validation:

permissions: {
    update: permissions.usernameMatchesField('user'),
    remove: permissions.usernameMatchesField('user')
},
fields: {
    user: fields.creator(),
}

Would make a sense to me if (e.g.) the following worked just as well:

permissions: permissions.usernameMatchesField('user'),
allow_extra_fields: true