Don't assume `$username` has good form. `url_encode` it.