Updated from feedback.

By the way, I notice this regex gets shown to the user on validation error. Is that safe?