Allow URL/API building via slug, not just PK

Should be backwards compat with existing PK behavior. Including paranoia like "what if some dude has a project whose *slug* is `"1234"`". Heh.