Escape the invite code on the sign-up page

Escapes the invite_code query parameter on the sign-up page, which blocks markup injection from a crafted link.