Remove serialisation of user-supplied data

PHP can’t reliably handle de-serialisation in a safe way. This plugin
was serialising and storing user-supplied data, leaving it open to a
security problem with de-serialisation in conjunction with a salt issue
(see e8b859c).

Thanks to vortfu for reporting this, via hackerone.com
Basic output escaping improvements
Make sure plugin actions are restricted to admins