FIX: Omit XSRF in response headers.
FEATURE: add httpAddWebSocketsRoute API

Also some cleanup.
FIX: Create “app” auth store universally.
CLEANUP: Update Deps and doc