protect against long usernames