fix username valid / invalid filtering

[dsschult]

There was a case where someone put a . in a username, which was valid, but not matching the url regex. Let the regex be more flexible, but also lock down new usernames to lowercase ascii letters + digits