Simplify search routing

This also adds specs for the basic `/search` URLs.
Also disallow DELETE, POST and PUT to /