Http api

First pass wire up of (most) HTTP endpoints but without authentication.
I'm a fan of custom types for the HTTP handler. We typically don't want to send back all the fields via the API and it's nice to be able to whitelist fields instead of remembering to blacklist them.