feat(users): add username validation for allowed characters