Use plugins_url() instead of WP_PLUGIN_URL

Prevents mixed-content warning on Unconfirmed admin page when FORCE_SSL_ADMIN is true. See boonebgorges/unconfirmed#19.
Readme
Bump version numbers to 1.2.7.
Merge branch '1.2.x'