Use plugins_url() instead of WP_PLUGIN_URL

Prevents mixed-content warning on Unconfirmed admin page when FORCE_SSL_ADMIN is true. See boonebgorges/unconfirmed#19.
Merge pull request #20 from dbarlett/master

Use plugins_url() instead of WP_PLUGIN_URL