Remove use of Panic in web api when throwing errors

Use Binding package to parse incoming JSON

Add support for OPTIONS calls to the API
Pull in some changes from go read and switch to using mjibson's sanitizer
package directly.