Escape the team.name output.

Since the team.name was not sanitized, it would be possible to
inject js against members of a team.
Add a test to make sure team name is html escaped.

This test is kind of silly and possibly not necessary, but including
for regression in case it is desired.
Merge pull request #1575 from bemurphy/bem-escape_team_name

escape team name