We need to think about how we will protect the "run" method in the medium term (especially if we intend to contribute some changes back).

I note there's a `app/controllers/api_controller.rb` with some comments that indicate there's a plan to do key-based authentication there (something rudimentary already in place).  Consider moving this code to that controller so that methods with similar auth requirements can be grouped together?

I also note that method creates a run directly rather than queuing it, though it's not obvious to me what the benefit of that would me. I guess it's streaming the output back to the client directly. I think we'd rather it was queued?