Http api

First pass wire up of (most) HTTP endpoints but without authentication.
Can you add some empty lines to break up the test? It makes it easier to separate the setup from the execution from the assertion.