putting all API endpoints under /api and disabling CSRF for them.
moved oauth api stubs to lib/api.js.