Hotfix/escape quotes

puiterwijk reported that he's getting a javascript error in pkgdb with a crafted display name.  Tracked this down to us not escaping the display_name value in this template.