api data race

Look at 4ae7fae to have a clearer idea on changes. These changes aren't new: we've been locking the blockmanager for reads and writes in the UI websocket handler for a while a now. This just adds the same level of memory-safeness to the rest of the API which was a long time coming. 

Every http handler that attempts to access blockmanager should be lock blockmananger before doing anything with it -- this prevents races and multiple http handlers from doing bad things when working at the same time.