[UP-3315] Fix some XSS issue around inputting usernames.

The issue was occurring because `</script>` always terminates the JS block -- even if that's inside a string.  The JS interpreter would terminate the block and then misinterpret the unterminated contents of the string as executable code.  The *right* solution for this is probably to start whitelisting the input characters for every input field. Any field that will be part of a RESTful URL should not be allowed to contain the `/` character.  The "solution" in this commit is intended as a stop-gap.  It solves this biggest issue -- the XSS vulnerability -- but it doesn't fully solve the issues caused by invalid chars in the input.  IMO, this is better than what we had, but still not great.