Add register post type argument

Add the `show_in_json` argument to `register_post_type` to control whether the type is available via the API.

Also picks up a couple of missed instances that we had; `/posts/<id>/comments` in particular, which didn't check that the post was valid.

Fixes #136.