GitLab

* Security update: correct misuse of `add_query_arg()` as identified by Sucuri: https://blog.sucuri.net/2015/04/security-advisory-xss-vulnerability-affecting-multiple-wordpress-plugins.html
* Bump WP compat

Remove unnecessary and incorrectly-used `$wpdb->prepare()` that triggers an error currently. Since no untrusted variables are added to the query, there's nothing to prepare.

See http://wordpress.org/support/topic/prepare-warning-in-35.