Added security fixes
 - database queries now use prepared statements
 - better random pass gen
 - csrf checks in ajax scripts

Moved admin page from app to admin section
Reviewed admin controls layout
Fixed password number requirement not saving/missing code