Fix org_name XSS path

You can specify `origin=cc` where cc is a country code as listed in the centroids FIPS10 column, and attacks will originate from there. Only works if one of the `_mode` args is _not_ specified

before change, org name of `org_name=<script>alert(%27xss%27)</script>` creates an alert box, confirming XSS. Changed to use the `.text()` property for proper escaping, closes XSS hole.

see, e.g. http://darrenpmeyer.com/pewpew/?org_name=%3Cscript%3Ealert(%27xss%27)%3C/script%3E&origin=us