At signs should be disallowed from usernames

[richbodo]

Otherwise, if users use their email address as their username, we end up exposing them like so on their profile:

  |