be more restrictive about acceptable usernames