It's not strictly necessary, but convention. Since controllers are not user facing, and the website may have its own '/user' path that does something different (like displaying user profile info), using `/api/` in the URL prevents collisions of this type. Let me know if you want it removed or changed to something else.