Thanks so much for creating this plugin!
On line 269, you're adding ?browser_assertion to the site_url, but it's safer to ensure a trailing slash on the url, so you want trailingslashit(get_site_url()). I ran into this issue on my own site, where site_url ends without the slash. It'd be great if you could make this fix.
There's also a number of other fixes which I think ought to be made (including removal of the "security risk" options... never make user-facing options which you don't think they should use). I'd be happy to contribute to the plugin. Feel free to get in touch via email, x@x.com x=mitcho if you'd like. :)
