update README to cgi escape usernames