Add httpHideRoute instead of “unused” as name.

This hides a route from route log tables. The route is still active.
This is used for inheritance routes.
REFACTOR: remove duplicate adding of XSRF token to session.
REFACTOR: harden test of empty string user name.
REFACTOR: rename mprGetJsonValue => mprGetJson.
mprLookupJsonValue to mprLookupJson.