SECURITY: Don't parse usernames as wikitext