I know that / and + are used in urls, so having those will do weird things to our pages, but why not @?
The reason is because you can log in with either your email address or username. If we allowed @ then it's not possible to tell (in the code) whether you are using a username or email.
For example one user could have the address [email protected] and a different user could use that as their username.
[email protected]