use .text() not .html() in stream rule editor to prevent DOM XSS

fixes #543