Forbid non-ASes from registering users whose names begin with '_'

synapse/handlers/register.py

@@ -53,6 +53,13 @@ def check_username(self, localpart, guest_access_token=None,
                 Codes.INVALID_USERNAME
             )
 
+        if localpart[0] == '_':
+            raise SynapseError(
+                400,
+                "User ID may not begin with _",
+                Codes.INVALID_USERNAME
+            )
+
         user = UserID(localpart, self.hs.hostname)
         user_id = user.to_string()