Well, that's because I'm an idiot. Fixed in 2d6478deac57c7b190dd95c0361ac0070ad15614

No, we can't blacklist characters, if we do anything security-like we can't half-ass it!