fixed username sanitizing, allowed range of items