admin: allow underscore (_) in user name