Safely add GET params to admin URLs

Use WP add_query_arg() in favor of string concatenation.