make usernames sane for url use