handshake API

Should we remove any of these routes that aren't being used anymore? (I'm thinking the password ones?)