Registration allows invalid username characters

I am unable to trigger the "Username contains invalid characters" warning on the registration form.

The totp.coffee file has this line of code: if !username.match(/[a-zA-Z0-9@\.-_]*/) but I think that Regex will always match (because anything is zero or more of those characters) and thus the condition always fails.