It already senses that it's members only, completely stock. If you look in the scripts file you'll see the line:
"regonly" => 1,
"admin_only" => 0,
"admin_or_mod" => 0,
By default, regonly is set to 1, which means that it will not allow it to be loaded unless you're a registered user, all done automagically (and easy to update if you want it to allow un-regged users).
It will however show the LINK TO it, however it will give an error "You must be logged in to use this feature" (or something similar, i don't recall the exact wordlet used).
Yeh, it'll need to allow only 0-9,a-z,A-Z and not start with a number; i could strip numbers and special characters out alltogether, but that woudln't solve too much as then you'd have the possibility for users using eachothers nicknames (you can, in this version, remove the nickname change box, and most users don't know about the /nick command; whch i could also filter, I'm contemplating introducing the filtered commands option in the next build)...
Will be giving it some thought though...