fixed username sanitizing, allowed range of items

I feel like the loading of stimuli into ['Stimuli'] might be better served by adding a custom function (to keep the login.php flow clean) but for now this is good.