New constraint: username must not contain spaces. Also, pattern-check it.
Implement roundtrip username validity checking, including a new /api route.