fixed to strict username regex