switched to connect-cookie-session which looks a lot better, will probably require people logging back in, can't do anything about that.

rework deployment configuration (using less of the express mechanism) so that configuration options are available at all levels

rework deployment configuration (using less of the express mechanism) so that configuration options are available at all levels

add an explicit db.open() call which will provide the hook for passing configuration information into the db layer

added CSRF protection and started moving actions that need it to POST, which automatically inherits CSRF protection. Not complete yet