Update API routing

Only respond to `/api` requests.

- Update POST response status code to 201 'Created'
- Add 405 Not Allowed response
- Refactor `res.status` chains into `res.send` calls