Only include PHP files in statistics/addons/

Previously, an admin could include files in other folders on the
stats addons page and incorrect files in the statistics/addons/ folder
could cause PHP warnings on the ACP stats page. Additionally, a missing
language string for error messages has been added.
Use users table constant instead of hard coding it