Http api

First pass wire up of (most) HTTP endpoints but without authentication.
@otoolep True.  We could copy to a different type, which I hate to do.  I'll experiment with creating a wrapper type with a custom `marshalJSON` function.