renamed clean:dist back to clean
really fixed dist command
re-work how the api token/csrf is setup locally
enabled ability to set apiUrl via settings cookie