now that username and mailboxes are totally separate, we can allow '-'. '+' is still reserved because LDAP it. Fixes #509