auto nickname is sanitized from oauth