Password validation for variations on username

This is probably what we’re going to do. There is more missing here, but the responses so far don’t make me think it is especially worthwhile to bring it up.