Api-ify the endpoints

Return 403, don't redirect
Return item info with offers
ensure logged in users more
allow fake users with X-Fake-User = email
sets cross origin stuffs