BadgeBuilder should html encode text content

Derp. Of course this should have been done from the very start. I'll blame it on being a while since I've had to deal with web stuff.