Reject usernames with # as user-type API parameters