API: Add remote-accessible endpoint to start transfer

Split request parsing from actually starting a transfer. Add an endpoint in
api/ (that doesn't require the caller to be logged in) that calls start
transfer as well.  Return the transfer's path.