routes: restricting api to :json format
angular: adding a catch-all route for pushstate

* fixes bug where hitting refresh button returns 404
updated client