rework deployment configuration (using less of the express mechanism) so that configuration options are available at all levels

added CSRF protection and started moving actions that need it to POST, which automatically inherits CSRF protection. Not complete yet

fix content-type of host-meta, which ultimately repairs the local testing setup (substitution is not performed on stuff that isn't text)

add /code_update handlers to all servers to allow unpriviled users with localhost access on the machine to shut them down with an http request (for code update)

generate a persistent secret for cookie encryption at first server run.  still in pursuit of zero-config and as stateless as possible.