Blacklist for usernames, display names and collection names (bug 1024630)

WiP: I still need to test the admin part.
I think it's more consistent to keep the name of the app as a prefix, which leads to another question: should it stay in the users' app? :)