move XSRFSecret from Server to ServerConfig