Don't create a user account every time a username with an apostrophe successfuly authenticates using LDAP

* decode HTML entities in username
* escape slashes when quering for existing users