security changes

changed $category_id to be absint in save-data.functions.php. Also changed width and
height to int in save-data.functions.php. Used
esc_url when $return_url is echoed out in API.php.
Let's add proper spacing here, `esc_url( $return_url )`.  Also, probably should wrap in `esc_js()`.