don't allow 'staff' as a login_name either