Since the default configuration in the samples, and presumably in quite a lot of systems will be that the username is the email address, it threw me off a little bit when discovering that the + sign is not an allowed character in a username.

I was thinking that it would be helpful to offer the email's allowed list (see this answer of someone diving into the allowed characters).

If this is not feasible (I can imagine that a username should be something remotely readable, although one could argue that an email should be as well), would it be possible to offer both versions of these strings as a const string in the user options class, so that this behavior is not repeatedly implemented by every application? In either case, the current implementation suggests it allows email addresses (the @ and .) but it doesn't actually fully implement this.

The string I use in my application (as far as I know I'm only missing the 'quoted' character requirement):

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!#$%&'*+-/=?^_`{|}~.@