strip username as well; handle invalid types in allowed field