One express.Router for the API (which is all 501 Not Implemented), and
another for serving individual images.

I suppose I could have used express.static for the latter, but exposing
an entire directory tree to random perusal didn't seem like such a good
idea.