Avoid filename disclosure by using a named key
Use menu_page_url(), which is a convenient helper function for menus registered in the admin
A better sanitization pattern
More appropriate escaping
Don't need these arguments
Sanitize these other two options, which were probably sneaking through previously
Merge pull request #8 from Automattic/vip-fixes

Some easy fixes I found.