work against profiler
 - implemented some session-token to limit access to profile data
 - researched structure to send onDemand data (still some minor bugs to iron out)
 - rewrote spells' access to model data and killed a redundant instance of ItemList
revisited sql escaping
in general, its not nessecary to manually apply escapes
- if passed as param to DB::DBType()->queryFunc() its escaped by DBsimple
- if passed as condition its escaped by BaseType
- if you do your own query use DB::DBType()->escape() on strings and intVal() respectively

- fixed use of HAVING in CreatureListFilter
- allow for exclude-only searches in Filter
- BaseType no longer adds %-wildcards to strings. Do this manually if ever nessecary.