security changes

changed $category_id to be absint in save-data.functions.php, used
esc_url when $return_url is echoed out in API.php. Changed width and
height to int in save-data.functions.php.