Http api

First pass wire up of (most) HTTP endpoints but without authentication.
Yeah, it's just one of those things that I focus on. A somewhat sophisticated user will see the hash field come back and might think "Do these guys know anything about being careful with hashes? Maybe it's blank now, but what about tomorrow?". I would hate people to think that about us. :-)