title: Why does models.User allow invalid characters in username?
body: <p>I feel rather stupid for asking this but I'll do it anyway.  The 'Users' API reference in the Django documentation <a href="https://docs.djangoproject.com/en/1.4/topics/auth/" rel="noreferrer">"User authentication in Django"</a> (v. 1.4) says that a username may only contain letters, digits, and the characters @, +, ., -, and _.  Yet I can go into the Python shell and do the following:</p>
  
  <pre><code>&gt;&gt;&gt; from django.contrib.auth.models import User
  &gt;&gt;&gt; u = User.objects.create_user('joe#')
  </code></pre>
  
  <p>Why doesn't this raise an exception?  I looked at the source code in ../contrib/auth/models.py and it doesn't appear to be flagging invalid characters.  What's going on here?  It would appear that if you want to catch an erroneous username, you'd have to do it via form validation.</p>