Fixed js injection order
Updated Postman dump for correct endpoints
Added placeholder for _probably_ all of the actions that will be allowed