Usernames can't break out of their container