added basic web test

of course `GET /outbox` should eventually result in 405, as that's
supposed to be a POST - this merely establishes the framework for TDD