avoid xss on account name (bug 834287)