Use the new bindparams method for sqlalchemy text clauses.

This lets sqlalchemy take care if proper escaping/quoting of variables.