fix template vulnerability created through insufficient sanitizing of username