only allow a simple set of characters in username/password.