only allow lowercase usernames