Http api

First pass wire up of (most) HTTP endpoints but without authentication.
Can you shorten the variables to `users` and `user`? No need to distinguish as `dbUser` in the context of this function.