[up-3315] Fix some XSS issue around inputting usernames.  The issue was occurring because "</script>" always terminates the
JS block -- even if that's inside a string.  The JS interpreter would terminate the block and then misinterpret the unterminated
contents of the string as executable code.  The *right* solution for this is probably to start whitelisting the
input characters for every input field. Any field that will be part of a RESTful URL should not be allowed to contain the '/'
character.  The "solution" in this commit is intended as a stop-gap.  It solves this biggest issue -- the XSS vulnerability --
but it doesn't fully solve the issues caused by invalid chars in the input.  IMO, this is better than what we had, but
still not great.
Merge pull request #373 from jhelmer-unicon/up-3315_fix_js_injection_for_create_user

[UP-3315] Fix some XSS issue around inputting usernames.