Several API fixes

* API views that require JSON post data as input will not raise HTTP 400 if the data cannot be JSON decoded properly
* When posting login view without username and password postdata, don't crash
* Delete API was using the wrong route