sanitize username input on account creation

- use regex to allow a username to be used if it only contains a-z, A-Z,
  0-9, underscore or period
- since the username is directly passed into a shell command later on in
  the user.create() function, leaving it unsanitized creates a command
  injection vulnerability
Merge pull request #1 from markmossberg/security/username_sanitize

good catch. I'll merge it into the main site.