added webapp.forbidden_usernames property to allow configuration of usernames to block.