in production (dev/beta/prod) use a more conventional logging format that includes timestamps.  closes #234

fix undefined reference (crash) in verifier after verification failure.  closes #523.  introduced in issue #82.

fix CSRF checking logic, once we identify a single problem with the CSRF token, don't fall through to further checks