Http api

First pass wire up of (most) HTTP endpoints but without authentication.
@otoolep @pauldix  I agree that we shouldn't have an upper limit.  How about the lower limit?