reject usernames that are too short or too long