putting a real csrf ;) + fixing the lost pass (not requiring captcha) + adding time to the password recovery key

adding license (agplv3), lastlog modules on prosody, and cron to disable / destroy accounts accordingly, fixing missing indexes in the DB, adding apache configuration files too