Add persisted XSS vulnerability in username.
Fixed search to allow for partial matching.