reject some characters from usernames because they make for URIs that are hard to handle