security changes

changed $category_id to be absint in save-data.functions.php. Also changed width and
height to int in save-data.functions.php. Used
esc_url when $return_url is echoed out in API.php.
Braces are only needed when there is more then one line of code being executed. My professor who was an old IBMER drilled this into my head. I actually got my grade knocked if I used braces for one line of code.