`/start/` route: read query string and add sensible defaults

This PR adds some more functionality to the `/start/` route on the server-side:

* Looks at `req.query`, and generates sane defaults for any missing query params.
* Exposes a POJO to the client-side via `express-state`