Fix org_name XSS path

before change, org name of `org_name=<script>alert(%27xss%27)</script>` creates an alert box, confirming XSS. Changed to use the `.text()` property for proper escaping, closes XSS hole.