encodeHTML for username