Adding note about basic auth username restrictions.

Thanks @rhelmer.