Hmm, username probably does not need any further filtering, as it comes from `request_var`. Or `url_encode` should be enough...