restrictions on username and password