fixed XSS in user name and project name properties