Fixed sec. vuln. for basic authN (core & ONE)

* Added username validation for basic authN
* Added username escaping before XPath queries
Added OS-based context. mixins to ONE model