lots of improvements.

on the server: using objectify, some classes for db objects, csrf token, code refactoring, rpc service and just enough auth and db to get things started.

on the client: error dialog, server module, updated infobox with loading state, responsive fixes, enough rpc to get things rolling