Issues #224, #226, DB update work. …

* For your dev environment, you probably want the following flags
auth.allow_insecure_cookie=true  // session on http
auth.allow_tokenless=true       // ignore CSRF token
* added the CSRF as <meta name="token">
* token should be passed back as "token" in the URI path.
** You can check stdout to see if the server is spotting the token
  ### checking Token ....
* first steps at fixing the db update stuff
** pulled table create into own create_db.sql
** this *should* prevent multiple indexes from being built...
* added db version stamp to meta.
** need to add sql dir update checker for new files & execute.
@nchapman r?

The way this works is that you'd pull token from here and include it in the URI of the POSTs later. 
you can specify 
    auth.allow_tokenless=true
in the config.ini file to get things to display without the token field. 

If passing it in the URL is a pain, let me know and I can see about coming up with something else. (Header?)