[api] be more careful with body and form data

Support also HEAD requests by not crashing but mapping to a backend GET
(which is not perfect, but at least the clients get an answer [including body])
[api] forgot to add the test cases for my last changes

rails4 generate uses different directories and I didn't bother forcing it
to the old location
[api] refactor search controller

move the actual rendering of items to the controller. xpath engine only
returns ids and the contoller then renders. This is so far only code
moving, but this gives the controller more controll over the pagination
and allows caching