viewuser.action has an XSS problem around username

Steps to reproduce:

1. create a user with username: foo"><script>alert('hello');</script><span class="ff
2. you should get an alert when you are redirected to viewuser.action to view the user you just created.