Route config for internal access only routes

[hueniverse]

Adds config.isInternal option which prevents a route from being accessed except from server.inject().