Escape method name in include? call

User.username was not working because the method name in the appropriate include? call was not being escaped.