fixed cross site scripting on the username and name fields

Fixed two cross site scripting issues on by HTML encode the username and name fields