Password validation for variations on username

[sam (Sam Saffron)]

I am fine to add a check when people pick a password for “password shall not contain username_lower” it seems reasonable to me.