api: use a flask Blueprint rather than adding to the app directly

This is a more flexible way of specifying the routing, see
http://flask.pocoo.org/docs/blueprints/ for more
api: get a logger from logging rather than using app logging
api: move Flask-Security setup to __init__ rather than in api