Update create.php

Disallow @ symbols in usernames