Refuse to start w/o data directory unless bootstrapping

Cassandra doesn't care if data directory isn't present, so it will happily create one and start, effectively losing existing data.  We could check environment and refuse to start if it's not the first start of the node.

A rolling update of a cluster will be required once after it is first created to remove the bootstrap flag.