added protection on User against XSS. resolves #77