add slug validator and sanitize string func
add username to user table.

This will cause incompatibility with previous versions, but it seems there's
no better way to do it. The whole url routing rules have to change.
since it's already incompatible, merge revisions.