FIX: XSRF token must be reset if session is recreated.
FEATURE: Add httpHideRoute instead of “unused” as name.

This hides a route from route log tables. The route is still active.
This is used for inheritance routes.
REFACTOR: Rename config.json “sendJson” to “json” and “xsrfToken” to “xsrf”.

Old names still supported, but deprecated.