Escaping enhancements:
* escape translated strings on output
* use `esc_textarea` vs `esc_html` inside a textarea element
* cast an int immediately prior to output