Add endpoint for fetching activity stats

This is secured by a token that is only accessible by the admin, and is
regeneratable on the /stats page.