and error out on internal ones

The core bundle no longer requires auth by default which means all
API endpoints can be accessed without any token now.

This adds one custom controlle which requires auth as an example.

Also adds some basic tests for all the added endpoints.