bugfix: disconnecting the wrong lurker. Also html escape usernames