So we are sure that the lock file is always in sync etc.

this is the easiest way, sadly...

They are public and https is easier to manage for beginners.

The core bundle no longer requires auth by default which means all
API endpoints can be accessed without any token now.

This adds one custom controlle which requires auth as an example.

Also adds some basic tests for all the added endpoints.