validate user name on both "create" and "update"

see also #18722
Merge branch '4.0/validate-user-name' into 4.0-trunk