Allow API access to validation creation

Not perfect - should be a 201 instead of 302, but this accepts a JSON list of URLs and gives you back validations.