Escape HTML characters in user name when showing it on a web page.

This addresses a security flaw in previous versions, pointed out
by Davy Stoffel.  A fake password reset email could be provided
to users, with the link:

    http://gitit.net/_doResetPassword?reset_code=azeaze&username=davy%3Cscript%3Ealert%281%29%3C/script%3E

If the person clicked the link, the unknown username would be
displayed (unescaped), and the javascript would run.

This fix addresses the flaw, not by preventing the funny user name,
but by ensuring that the HTML tags are escaped when the user name
is shown on the page.