sanitize username input on account creation

- use regex to allow a username to be used if it only contains a-z, A-Z,
  0-9, underscore or period
- since the username is directly passed into a shell command later on in
  the user.create() function, leaving it unsanitized creates a command
  injection vulnerability