it's sort of weird because we have a web flow (no auth) and then an API (requires oauth). I guess it would have been nice to prefix those with ``/api/``, ah well.