Add endpoint for fetching activity stats

This is secured by a token that is only accessible by the admin, and is
regeneratable on the /stats page.
Use `isAdmin()` as defined in db.js. (I think your code here will throw an unexpected exception if the user is not logged in.)