It was already forbidden for ui.username() but no verification were made for username passed through the commandline.