Make sure that username cannot contain html characters. Also checks for ...

...username length limit of 128-characters long (it assumed it was 64-characters). Handles #496.