Add `GET /api/states` route

Such a route is easier with CORS handling. Otherwise, we could also
implement the `OPTIONS` handler.