Whitelist /api/ and /data/ requests for LOCKDOWN mode.

The /api/ exception is needed for /api/status, so it properly renders the top nav items.

The /data/ exception is needed to render channel resources like the logo.