Sanitize Expense.sum_in(currency)

In theory, the `currency` in Expense.sum_in(currency) should not have to
be sanitized because it comes from the expenses.currency database
column, which should have been validated against a list of approved
currencies. But let's sanitize them anyways just in case