^(?!_|-)([a-zA-Z0-9]|[\-_](?!_|-|$)){3,16}$
Matches
-the start of the string
-checks that the first character is not _
or -
-a token that is (one alphanumerical) OR (one hyphen/underscore that is NOT followed by a hyphen/underscore/end of line)
-the above token, 3 to 16 times
-the end of the string