That's a pretty good idea (as long as these are considered "transactional" by the provider).

edit: Can confirm the authentication behavior now.

edit 2: In fact, the username is printed without any escaping.