username can only include letters, numbers, or underscore