dev: All routes ending in _json are excluded from csrf protection now
dev: a more consistent look & feel for plugins / pluginsettings