fix xss in some currently unused code

this UI is not currently accessible and is probably going away, but just
in case...

Change-Id: I6a1fb50696a66f6fd6855d7c7b37a3d4d859b377
Reviewed-on: https://gerrit.instructure.com/46291
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Cody Cutrer <cody@instructure.com>
Product-Review: Jon Jensen <jon@instructure.com>
QA-Review: Jon Jensen <jon@instructure.com>