Prevent ApiAddStudents enrolling invalid users

Due to a bug, ApiAddStudents did not properly control for malformed
usernames. The API would attempt to add malformed usernames, leading
to an invalid DB state. Fortunately this did not happen much, thanks
to AJAX/client-side checks. This patch fixes the issue.

Bug: 66624
Change-Id: I789ffec1daeb41b566a6dc35a214ee6986c63527