Fixed XSS issue in user names, closes #217