fix XSS in users.helpers._user_link (bug 990078)

fix [bug 990078](https://bugzilla.mozilla.org/show_bug.cgi?id=990078)

There was a test in ```users.tests.test_helpers.test_user_link_xss``` that was
in fact broken and only partially tested the XSS (the username part, not the
name part, sadly).

I'm thus not sure it's a regression, just an XSS that slipped through until
now.