Http api

First pass wire up of (most) HTTP endpoints but without authentication.
`StatusOK` is default if we don't write any other.