escape a redirect URL; corrected a user cap; use WP_User object for calls to user_can() when possible
use get_field_name() to get form field names; get the advisory payment costs from the config file; more code-review updates