Config form security additions,
misc other stuff
added api_key flag, fixed a bug initing the cookie_secret