separate user and device routing; make API more RESTful; split out the heartbeat route