Escape the username to prevent js injection

This should fix #65 .