One form, then cheap tokens

Username: 3 to 20 characters, lowercase letters, digits or _. Password: at least 8 characters.