Minor tweaks, make /jsapi/ a maybe-authenticated endpoint