new rule: username must be combined by a-z0-9