bad-username.message in messages.properties

[Nate Klingenstein]

Hugo,

> Thank you (and replying on a Sunday, I dont think you take breaks from following the list past 2 years).

Rehab is a long slog.

> From my understanding, the invalid login message appears on the login.vm page; via #parse("login-error.vm")

I think it's getting encoded as a string by the $encoder.encodeForHTML($message) in login-error.vm.  Try changing it to just $message.  I'm not sure what the collateral damage of that is, if any, so you might want to wrap that in an if clause to trap just this one message type.

Take care,
Nate.