security changes

changed $category_id to be absint in save-data.functions.php. Also changed width and
height to int in save-data.functions.php. Used
esc_url when $return_url is echoed out in API.php.
Consult the [coding standards for space usage](http://make.wordpress.org/core/handbook/coding-standards/php/#space-usage) (Here and elsewhere).

Notably:
* Space between if().  
* Yoda Condition.
* Space in parentheses.