We typically escape usernames. Let's also do it here.