Improve catchall routes

[GrahamGoudeau]

For convenience, it would be good to make a new route that matches /api/* route so that, during development, calls to an incorrect api endpoint can return a more sane error response (something like { error: { message: "unknown api endpoint"}}) instead of a blob of HTML.

As another part of this, it would be better to split out the /* and /api/* routes to standalone calls to routeManager.addInsecureRoute() and routeManager.addSecureRoute() respectively (after the calls that take the arrays of routes), so that they don't get accidentally get bundled in with the other routes out of order.