Offloaded username sanitization to the server, also some client-side string checking