encode the userId on the schedule page

prevents a possible XSS attack
encode userId & school when editing schedule

prevents XSS
added bottom padding to the classmates list