security changes

changed $category_id to be absint in save-data.functions.php. Also changed width and
height to int in save-data.functions.php. Used
esc_url when $return_url is echoed out in API.php.
This is already cast to an integer in the `get_term_by` function.  We don't need to do anything here, but if we do anything, let's go ahead and just cast as `(int)`, rather than using absint().