isolate effects of middleware from other routers

Using all(...) in this manner allows middleware from router A to
not affect router B.

As a result, sendJSONStatus and ability to optionally end in
.json disappeared, which this patch also restores.

CC: @jasoncalabrese
With this change, I can successfully restrict reads to entries
vs status vs other things without the middleware leakage we
observed earlier.

lib/api/entries/index.js

@@ -574,7 +574,7 @@ curl -s -g 'http://localhost:1337/api/v1/times/20{14..15}/T{13..18}:{00..15}'.js
       * posted back out.
       * Similar to the echo api, useful to lint/debug upload problems.
       */
-    api.post('/entries/preview', function (req, res, next) {
+    api.post('/entries/preview', ctx.authorization.isPermitted('api:entries:create'), function (req, res, next) {
       // setting this flag tells insert_entries to not actually store the results
       req.persist_entries = false;
       next( );

lib/api/index.js

@@ -40,17 +40,27 @@ function create (env, ctx) {
     app.use('/experiments', require('./experiments/')(app, wares, ctx));
   }
 
-  // Status first
-  app.use('/', require('./status')(app, wares, env, ctx));
 
+  app.use(wares.extensions([
+    'json', 'svg', 'csv', 'txt', 'png', 'html', 'tsv'
+  ]));
+  var entriesRouter = require('./entries/')(app, wares, ctx);
   // Entries and settings
-  app.use('/', require('./entries/')(app, wares, ctx));
-  app.use('/', require('./treatments/')(app, wares, ctx));
-  app.use('/', require('./profile/')(app, wares, ctx));
-  app.use('/', require('./devicestatus/')(app, wares, ctx));
-  app.use('/', require('./notifications-api')(app, wares, ctx));
-  app.use('/', require('./verifyauth')(ctx));
-  app.use('/', require('./food/')(app, wares, ctx));
+  app.all('/entries*', entriesRouter);
+  app.all('/echo/*', entriesRouter);
+  app.all('/times/*', entriesRouter);
+  app.all('/slice/*', entriesRouter);
+
+  app.all('/treatments*', require('./treatments/')(app, wares, ctx));
+  app.all('/profile*', require('./profile/')(app, wares, ctx));
+  app.all('/devicestatus*', require('./devicestatus/')(app, wares, ctx));
+  app.all('/notifications*', require('./notifications-api')(app, wares, ctx));
+
+  app.use('/', wares.sendJSONStatus, require('./verifyauth')(ctx));
+  app.all('/food*', require('./food/')(app, wares, ctx));
+
+  // Status first
+  app.all('/status*', require('./status')(app, wares, env, ctx));
 
   return app;
 }

lib/api/treatments/index.js

@@ -20,7 +20,7 @@ function configure (app, wares, ctx) {
   api.use(ctx.authorization.isPermitted('api:treatments:read'));
 
   // List treatments available
-  api.get('/treatments/', function(req, res) {
+  api.get('/treatments', function(req, res) {
     ctx.treatments.list(req.query, function (err, results) {
       return res.json(results);
     });