escape things; default to 'anon' as the username
actually loads data from the server now