fixed a problem where usernames and error messages in particular were not xml entity encoded leading to broken cas 2.0 responses