Email validation option accepts emails with dashes

Hyphen was not escaped in the local part's character class.

This still leaves the regex short of what is recommended by RFC 3696.
The correct solution may be to use the "email" value for the type
attribute on component's associated input element, introduced in HTML5.
Options prefixed with '__' are not sent to client

Otions values that might contain sensitive information can now use
a prefix of '__' on the option name to prevent the value from being
sent to clients.

Note: Options prefixed with '__' are not special-cased on the server
and server-side code will need to refer directly to the prefixed name
to make use of these variables.
Also, the option names are still sent to the client, please be careful
if those option names contain sensitive information as well.