Missing esc_attr() and esc_url()'s. Cleanup for 2.1