For usernames it's reasonable. People identify other people based on usernames, so allowing unicode control charachters or zero-width spaces would not be good.

For usernames it's reasonable. People identify other people based on usernames, so allowing unicode control charachters or zero-width spaces would not be good. If your username is only for login then it should be fine to allow anything. For passwords it's just bad practice. Allow everything, and allow it to be very long.