permit `.` in usernames