disallow invalid usernames