Use plugins_url() instead of WP_PLUGIN_URL

Prevents mixed-content warning on Unconfirmed admin page when FORCE_SSL_ADMIN is true. See boonebgorges/unconfirmed#19.