Standardize line endings
Don't use 'echo' in templates but p() for security reasons
Add CSRF protection on settings form.