More strict username check. Closes #426.