don't escape usernames server-side