Partially bring back API

There are still a lot of TODO notes to sort out:

* The API is not using authentication yet like the original did
* The API does not set the correct HTTP status codes on errors yet
* Creating an API key is broken because the original API didn't seem to require a user
Merge remote-tracking branch 'origin/master'