api: username validation