To make sure you don't break anything (a username "login") you want to register to handle unhandled routes (404s). I can't remember how Elgg does this.

MAybe you will need this plugin https://elgg.org/plugins/1091233

or this https://elgg.org/plugins/2428620

Also, those plugin will prevent users to make  username like "login" , "blog" , "thewire" , etc

Profile URL plugin: https://elgg.org/plugins/1091233.

It doesn't show Elgg 2.0 and newer as compatible but maybe it still works. It's not using the [route, all] plugin hook, yet, but it shouldn't be too difficult to update. It also checks on registration of user accounts if the username is also blocked by an existing pagehandler (this won't help if you add a plugin at a later time and the username is already taken though).

Did you mean to close this discussion?

It sounds like Elgg was occasionally booting without your session, either by the browser not sending the cookie, or some bug in our session component. Please issue a bug on GitHub if it keeps happening.