De-namespace new API controllers

* Temporarily keep old controllers in /old for reference
* Set up skeleton "client" controller to serve the JS client