Http api

First pass wire up of (most) HTTP endpoints but without authentication.
yeah, I don't think we should have any artificial limits on the lenghts.