Fixed XSS in user name and project name properties

It was possible to inject JS to some fields, so now it's fixed :)