forbid username with '\n' at the changelog level It was already forbidden for ui.username() but no verification were made for username passed through the commandline.