The Endex

Security / Hardening

• Removed all reflective private field access (replaced with explicit getters and helper methods) to improve transparency and reduce maintenance risk.
• Web session auth now migrates ?session= token into Authorization: Bearer <session> header; SPA strips token from the URL (prevents accidental leakage via history/referrer).
• Added hashed API token support (web.api.token-hashes) using SHA-256 lowercase hex digests with constant-time comparison.
• Plain web.api.tokens still accepted for backward compatibility; one-time deprecation warning when hashes also configured.