last_seen_api: escape nicknames more aggressively