firstrun: don't allow forbidden chars in user registration