Coopr 581: Implement node hours REST API

should be using parameterized queries to avoid sql injection.  The string has to have '?' where the input would go, and then the prepared statement has to call '.setString' or '.setTimestamp' on the fields.