move JSON routes to /api namespace

This way they won't conflict with any potential client side routes.