Issues #224, #226, DB update work. …

* For your dev environment, you probably want the following flags
auth.allow_insecure_cookie=true  // session on http
auth.allow_tokenless=true       // ignore CSRF token
* added the CSRF as <meta name="token">
* token should be passed back as "token" in the URI path.
** You can check stdout to see if the server is spotting the token
  ### checking Token ....
* first steps at fixing the db update stuff
** pulled table create into own create_db.sql
** this *should* prevent multiple indexes from being built...
* added db version stamp to meta.
** need to add sql dir update checker for new files & execute.
There is [some concern](https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29_Prevention_Cheat_Sheet#Disclosure_of_Token_in_URL) about passing the token in the URL, but it seems to be specific to GET requests. I think this will work just fine for me! r+ unless @st3fan says otherwise :smile:.