disallow underscores in usernames