Safely add GET params to admin URLs

Use WP add_query_arg() in favor of string concatenation.

Had an issue together with a plugin development. 
... hope you're accepting PRs.
cheers, j.