Tests for all api routes, closes #20