move datacollector.php to /api with currently unrestricted access