better handling on html special chars in password and username.