username sanitizing improved