Just occurred to me: do we need to sanitize the username in any way? I'm assuming that there aren't any special characters that could somehow end up in it that would break anything (presumably things like double-quotes get properly escaped when serializing into JSON)...but just wanted to check for paranoia's sake.