Fixed sec. vuln. for basic authN (core & ONE)

* Added username validation for basic authN
* Added username escaping before XPath queries