fix user name xss