<p><span class="h-card" translate="no"><a href="https://mastodon.social/@whitequark" class="u-url mention">@<span>whitequark</span></a></span> username passed plainly instead of being tokenized? This isn't my area, but a username and sessionID together seems like it could be bad.</p>
