server's username validation is weaker that client's validation

client code:

Line 87 in ae40a75

    
           const validateUsername = (u: string): ({ reason: "", ok: true } | { reason: string, ok: false }) => {

the server code doesn't validate that the username doesn't contain the string "scrobble".

The server actually does check for this already.