RouteKind

Who calls an HTTP route: a browser, which carries a session and so a CSRF token, or a program, which carries neither.

Not an enum, because neither value is named outside eezo, and an enum's cases cannot be hidden. Every route an application builds by hand is a browser route by leaving the field out, and the way eezo mints an API route is a handler that takes an ApiRequest, through the generated row. A kind an application could name would be a way to turn off the CSRF check on a page that reads the session, with nothing in the handler's type to say so.

Naming is all this closes, not holding: kind is a public field, so an application can copy it from an existing API route onto a page whose handler takes a Request. What keeps such a page harmless is that RouteTable.running empties the session on every API route whatever handler it runs, and the server reads no cookie for one, so a forged request reaches the page as nobody rather than as the signed in user.