XSS with username, i hope the only one, but...