added CSRF protection and started moving actions that need it to POST, which automatically inherits CSRF protection. Not complete yet

fix content-type of host-meta, which ultimately repairs the local testing setup (substitution is not performed on stuff that isn't text)

add /code_update handlers to all servers to allow unpriviled users with localhost access on the machine to shut them down with an http request (for code update)

generate a persistent secret for cookie encryption at first server run.  still in pursuit of zero-config and as stateless as possible.

move to encrypted cookies for persistent auth with the IP, fix several usability bugs related to the abscense of this

clean up webfinger support in authority: use mustache for templating cause it's hot, include Subject tag, support & expect acct: prefix