ThatSong API — use /api/* routes