very basic API

- POST item
- GET item
- GET items
- POST sightings using item's secretCode
- GET sightings

no editing or deleting allowed yet