added CSRF protection and started moving actions that need it to POST, which automatically inherits CSRF protection. Not complete yet

fix content-type of host-meta, which ultimately repairs the local testing setup (substitution is not performed on stuff that isn't text)

add /code_update handlers to all servers to allow unpriviled users with localhost access on the machine to shut them down with an http request (for code update)

generate a persistent secret for cookie encryption at first server run.  still in pursuit of zero-config and as stateless as possible.

move to encrypted cookies for persistent auth with the IP, fix several usability bugs related to the abscense of this