more terse api, exposing get and post only on app, injecting more variables to view