added REST controller, still not working due to 'not found: type ObjectId'