Simplify UserDevices to use standard getUser()

Previously was duplicating effort handling session stuff. This was
causing the force_user to fail.
Fixed missing code in lock command.
Merge pull request #219 from mozilla-services/dev

Fixed missing code in lock command
Added missing passcode classes.
Merge branch 'master' into dev
Merge pull request #220 from mozilla-services/dev

Added missing passcode classes
Merge branch 'master' of github.com:mozilla-services/FindMyDevice into dev
Issues #224, #226, DB update work.

* For your dev environment, you probably want the following flags
auth.allow_insecure_cookie=true  // session on http
auth.allow_tokenless=true       // ignore CSRF token
* added the CSRF as <meta name="token">
* token should be passed back as "token" in the URI path.
** You can check stdout to see if the server is spotting the token
  ### checking Token ....
* first steps at fixing the db update stuff
** pulled table create into own create_db.sql
** this *should* prevent multiple indexes from being built...
* added db version stamp to meta.
** need to add sql dir update checker for new files & execute.