make sure we sanitize the coupon_code input

Thanks Brian Christian for reporting this!