constrain username, not password