CSRF handling

[WolfgangFahl]

Today i also ran into the CSRF handling issue which is considered fixed by #100. I can not access my admin interface at this time since it is too late. I did not set the env variable so i am locked out.
Also i do not understand how to keep the ui (and admin) settings persistent. I keep getting my settings to be overridden without me understanding what is happening. The dependence on the Django technology is quite akward for me since this i the only context in which i am getting in touch with Django. Django experts will proably feel this is all easy and simple. For me it is a major obstacle.

E.g. the see the default .env file for a complete list does not have a pointer to that .env file

I assume

QLEVERUI_DATABASE_URL=sqlite:////absolute/path/to/db/qleverui.sqlite3

is the key to persistent settings - so an external sqlite file may be used. I assume to get a working file first a docker cp is needed.