add referer to command based auth, and escape encode it and agent.
prevent inactive mountpoint stats (with active fallback) being dropped

Instead of dropping inactive source stats and then rechecking sources/config, we now use a
updated timestamp to reflect entries to keep, then purge afterwards.  This avoids having a
small window of opportunity where missing stats could trigger a slave to terminate streams.