Introduce a new router instead of the main app.router.

this allows us to decide where to mount the application specific routes,
which in turn should allow us to avoid killing the routes added in
modules like graft-auth.
split out the router to a new submodule.
move away from bodyDecoder, which creates temp files.
static should be before server middleware.