move actions to /action, accept POST data from other hosts (e.g. figurehead)