Your cmd is a member variable of the form, so retains it's parameters after you've used it for the first time.
Then, when you try to add the @username parameter to *the same* cmd object again, it croaks.
Always dispose a sql Command object by wrapping it in a using block so that it is disposed correctly.
using (cmd = new SqlCommand(...))
{
cmd.Open();
....
}