Move quickstart template to tutorial
Move json endpoint to root
Imitation of bearer token control

!Warning!: very silly code just to allow similar behavior as if we
were using OAuth2 with a bearer token.  This should be removed in
production.
Allow retrieving /json with no token
Add a rendered tutorial