fixed XSS vulnerability

Thank god the username is truncated, which kills most of the useful stuff you could do.
Also, fixed one unrelated HTML error.
Merge pull request #96 from webvariants/master

fixed XSS vulnerability