Better handling of unrouted HTTP requests and OPTIONS

* Requests that don't match any route get a 404 or 405 response as
  appropriate, based on whether there's a route for that URL with any
  other HTTP method.
* 405 responses return an Allow header with a list of valid methods.
* OPTIONS returns an accurate list of methods for that URL.
Small REST improvements

* GET / response has a "ADMIN":true property on the admin port.
* Admin-only handler methods will panic if called in a non-admin context
  (only possible if someone screws up the routes in router.go.)
* Moved some handler methods between source files.