Are there any good **security** reasons for a web application to limit the length of a username?

If there is, what should be the minimum and maximum length allowed?