updated security changes per Justin's request

changed esc_url to esc_js used (int) instead of function int, changed
from absint to (int) per request.