You should use single quotes on the value parameter, ie:
value='<%=request.getParameter("userName")%>'
or set the org.apache.jasper.compiler.Parser.STRICT_QUOTE_ESCAPING parameter to false as described here:
http://blogs.sourceallies.com/2009/10/strict-quote-escaping-in-tomcat/