This appears to have just been an oversight -- CREATE USER was not enforcing
  the existing username limitations.