Fixed possible vulnerability in docs

It was only checking for a single letter, not that the entire thing
consisted only of letters.