XSS injection through usernames (firstname, lastname)

Test case:
1. Sign up with this as your first name:
<script>alert("hole");</script>
2. edit some pages.
3. logout.
4. wander around the wiki and count the number of times you get the alert.

Possible fix:
XWiki.getUserName(String user, String format, boolean link, XWikiContext context)
returns an html link if it can find the user object and we can reasonably assume that a link should not have html inside of it so we should be able to safely change the behaviour in cases where it is getting the link.