Issues #224, #226, DB update work. …

* For your dev environment, you probably want the following flags
auth.allow_insecure_cookie=true  // session on http
auth.allow_tokenless=true       // ignore CSRF token
* added the CSRF as <meta name="token">
* token should be passed back as "token" in the URI path.
** You can check stdout to see if the server is spotting the token
  ### checking Token ....
* first steps at fixing the db update stuff
** pulled table create into own create_db.sql
** this *should* prevent multiple indexes from being built...
* added db version stamp to meta.
** need to add sql dir update checker for new files & execute.
Ah, good point. Moving this to an X-CSRFTOKEN request header, which should keep the POST body JSON sane, but make the call much harder to forge.