sanitize username input on account creation

- use regex to allow a username to be used if it only contains a-z, A-Z,
  0-9, underscore or period (basically no weird characters like ; or -)
- since the username is directly passed into a shell command later on in
  the user.create() function, leaving it unsanitized would create a command
  injection vulnerability