fixed cross site scripting on the username and name fields

Fixed two cross site scripting issues on by HTML encode the username and name fields
`user.username` is referenced here twice, you've only escaped one of them.