Not all API endpoints are fine

[eboileau]

Aims/objectives.

We would like in the short-to-medium-term to provide a fully fledged and well-documented REST API service.

Most API endpoints should be safe and directly reachable, but not all (only via FE). Other endpoints, e.g. those related to the Compare view, may be more complicated to handle.

See also #74.

A clear and concise description of todo items.

• The first thing to do is to go through all endpoints, and make sure they all have proper "data validation", adequate error handling, and to handle restricted endpoints appropriately.