[up-3315] Fix some XSS issue around inputting usernames.  The issue was ...

...occurring because "</script>" always terminates the

JS block -- even if that's inside a string.  The JS interpreter would terminate the block and then misinterpret the unterminated
contents of the string as executable code.  The *right* solution for this is probably to start whitelisting the
input characters for every input field. Any field that will be part of a RESTful URL should not be allowed to contain the '/'
character.  The "solution" in this commit is intended as a stop-gap.  It solves this biggest issue -- the XSS vulnerability --
but it doesn't fully solve the issues caused by invalid chars in the input.  IMO, this is better than what we had, but
still not great.