Usernames need `esc_attr()`