Escape XML control characters in username and password.

Still unsure about encoding, if Turbine allows non-ASCII characters,
we might still have an encoding problem, especially with Python 2.x.