Use Auth class instead of constants - will allow better masquerade function.  Escape username, to remove restriction on allowed characters.