Pass `__FILE__` to `plugins_url()` so that this plugin works with a plugin directory that has been moved to a location other than the default one.

Also a small security fix.