User settings

This is a pull request for issues #455 and #456.

You could move some of those checks to `lib` so that they are available both on the client and server. You could add them as class methods to `User` document.

Here you allow 3 character long usernames, but above you require 6.