Http api

First pass wire up of (most) HTTP endpoints but without authentication.
It doesn't look great to our users, even if we blank it out. I would really prefer if there was no mention of hash at all in the JSON object returned to the user. 

Any other options? Don't export it, but have a getter for it?