minor js fixes
categories, csrf protection for flask-admin
requires features in master, not pushed to pip
Merge branch 'scheduler'