Optionally hide routes and fields based on user-provided callable

Doesn't pass any info about the route about to be (un)hidden - for that, it'd make more sense to pass callable instead of a bool each endpoint's/field's `hidden` parameter.