title: Why is this regex allowing a caret?
body: <p><a href="http://regexr.com/3ars8">http://regexr.com/3ars8</a></p>
  
  <pre><code>^(?=.*[0-9])(?=.*[A-z])[0-9A-z-]{17}$
  </code></pre>
  
  <p>Should match "17 alphanumeric chars, hyphens allowed too, must include at least one letter and at least one number"</p>
  
  <p>It'll correctly match:</p>
  
  <pre><code>ABCDF31U100027743
  </code></pre>
  
  <p>and correctly decline to match:</p>
  
  <pre><code>AB$DF31U100027743
  </code></pre>
  
  <p>(and almost any other non-alphanumeric char)</p>
  
  <p>but will apparently allow:</p>
  
  <pre><code>AB^DF31U100027743
  </code></pre>