Yup. I vaguely recall having to include something like this for a site I built years ago. I didn't code the filter myself, but I remember the feature request that usernames and passwords be filtered based on a profanity list. Users weren't blocked, they would just get "you can't do that" response. The passwords were inspected in memory as part of the request process after HTTPS decryption and before running through the digest function and sent to the DB.