validate format of username
display form only for logged in users
authenticate before create