diff --git a/includes/WPStrava/AuthRefresh.php b/includes/WPStrava/AuthRefresh.php
index 2604a50..3079eb3 100644
--- a/includes/WPStrava/AuthRefresh.php
+++ b/includes/WPStrava/AuthRefresh.php
@@ -104,9 +104,11 @@ class WPStrava_AuthRefresh extends WPStrava_Auth {
 		$strava_info = $this->token_request( $data );
 
 		if ( isset( $strava_info->access_token ) ) {
+			// Translators: Token refresh success message.
 			$this->feedback .= __( 'ID %s successfully re-authenticated.', 'wp-strava' );
 
 			if ( $strava_info->access_token != $info->access_token ) {
+				// Translators: New token created message.
 				$this->feedback .= __( 'ID %s access extended.', 'wp-strava' );
 
 				$settings = WPStrava::get_instance()->settings;
diff --git a/templates/admin-settings.php b/templates/admin-settings.php
index 762de55..6d732fc 100644
--- a/templates/admin-settings.php
+++ b/templates/admin-settings.php
@@ -2,7 +2,7 @@
 	<div id="icon-options-general" class="icon32"><br/></div>
 	<h2><?php esc_html_e( 'Strava Settings', 'wp-strava' ); ?></h2>
 
-	<form method="post" action="<?php echo admin_url( 'options.php' ); ?>">
+	<form method="post" action="<?php echo esc_attr( admin_url( 'options.php' ) ); ?>">
 		<?php settings_fields( $this->option_page ); ?>
 		<?php do_settings_sections( 'wp-strava' ); ?>