start migrating flask-restful classes to flask-classy views
got it all back together again with new views for json POSTable endpoints, now exempt from CSRF protection