Enforce userName and title can only containing aphlanumeric and dashes

Enforce data integrity basically, important since they're used for urls
I could do url encoding, but the idea is the the url looks good so
its helping keep the feel of the website

api/src/services/users/users.js

@@ -40,6 +40,9 @@ export const updateUser = ({ id, input }) => {
 export const updateUserByUserName = async ({ userName, input }) => {
   requireAuth()
   await requireOwnership({userName})
+  if(input.userName) {
+    input.userName = input.userName.replace(/([^a-zA-Z\d_:])/g, '-')
+  }
   return db.user.update({
     data: input,
     where: { userName },