Http api

First pass wire up of (most) HTTP endpoints but without authentication.
Curious -- where did we get these limits from?