error handling
disallow additional characters in user names