escape team name

html escape the team name for security.  Note this introduces the common `h` helper found in Sinatra apps.  As the helper is new to the codebase, perhaps there's a preferable pattern instead to achieve the same goal (Sanitize input, perhaps?)