more stringent username validation