Http api

First pass wire up of (most) HTTP endpoints but without authentication.
I wouldn't enforce a lower limit either. Let people do what they want to do with it