Fix bug where password change routes were not exempt from the strict

policy.
Add WebSocket setting that can be used like the media route setting to
define the pattern that should be exempt from strict mode.