Add `api` parameter to indicate success/failure with HTTP status.

Also, accept either GET or POST for requests to `/setup/password` and
`/setup/finish`.