Test the API all nice and proper-llike

[Atulin]

• Unhandled exceptions should not produce any HTML code
  • Entirely possible that they will be caught by exception handling middleware, which will redirect to an error page. That is... undesireable for an API
• Make sure validations work properly
• Make sure X-CSRF tokens work properly and their lack actually blocks user's access to the endpoint