Limit usernames to ^[0-9A-Za-z \-\_]+$

This will prevent HTML injection attacks whereby a user could put arbitrary HTML in their username.