This appears to have just been an oversight -- CREATE USER was not enforcing
  the existing username limitations.


mysql-test/r/grant.result:
  Add new results
mysql-test/t/grant.test:
  Add new regression test
sql/sql_acl.cc:
  Enforce the user and host name limits in mysql_create_user().