escape username field on login page

The username field needs be escaped otherwise it's vulnerable to xss attacks.