Sanitize header name on SlickGrid view. Fixes #465

SlickGrid will use `$.html`[1] to render the header cell contents.

This means that if you are loading an external dodgy CSV like the
following one, scripts will be evaluated:

```
field1,field2<script>alert(123)</script>,field3
data1,data2,data3
data1,data2,data3
```
This fix sanitizes the label when initializing SlickGrid removing all
that isn't text.

[1] e6e2f88f83/slick.grid.js (L563)

src/view.slickgrid.js

@@ -160,10 +160,15 @@ my.SlickGrid = Backbone.View.extend({
       })
     }
 
+    function sanitizeFieldName(name) {
+      var sanitized = $(name).text();
+      return (name !== sanitized && sanitized !== '') ? sanitized : name;
+    }
+
     _.each(this.model.fields.toJSON(),function(field){
       var column = {
         id: field.id,
-        name: field.label,
+        name: sanitizeFieldName(field.label),
         field: field.id,
         sortable: true,
         minWidth: 80,