Check that usernames are not equal to '..' to avoid path traversal.