Ensures username is escaped in user service