API: sanitize username

https://github.com/marienfressinaud/FreshRSS/issues/13