wip: Add rest api

Close #29
Implements #30 
cmd.sub will always be `'stop-cpu-profiling'` or `'heap-snapshot'` in this code path, won't it?

Maybe the error handler this appears to have been copy/pasted from above should be turned into a `die()` function instead?