now bad usernames don't break the webapp