Issues #224, #226, DB update work. …

* For your dev environment, you probably want the following flags
auth.allow_insecure_cookie=true  // session on http
auth.allow_tokenless=true       // ignore CSRF token
* added the CSRF as <meta name="token">
* token should be passed back as "token" in the URI path.
** You can check stdout to see if the server is spotting the token
  ### checking Token ....
* first steps at fixing the db update stuff
** pulled table create into own create_db.sql
** this *should* prevent multiple indexes from being built...
* added db version stamp to meta.
** need to add sql dir update checker for new files & execute.
Back on that topic, we should standardize.

- X-CSRFTOKEN
- SESSION_CRSFTOKEN
- crsftoken
- CRSToken
- crsToken
- (some generic ones like token and stoken which are probably unrelated)

I vote for CSRF (Cross-Site Request Forgery) and probably the following:

- X-CSRFTOKEN
- SESSION_CSRFTOKEN
- csrfToken

![Whatever, man](http://static.comicvine.com/uploads/original/14/149743/3056035-the+dude+forum.jpg)