Rework cart API

* rename to /data/carts
* return all carts from /data/carts for client-side filtering
* make /data/carts authenticated
* ignore DELETE for now (instead delete old carts after e.g. 2 weeks)