Http api

First pass wire up of (most) HTTP endpoints but without authentication.
Big fan of whitelisting stuff like this, as opposed to blacklisting.