fix username sanitizing lets users set $*&$ as username which becomes blank username (thanks @stevelacey)