Use underscore
Add locked flag
Fix urlRoot for challenge model
Extend API to get a specific challenge and to also create a challenge