API-endpoints should only be served via serverUri

Today the server doesn't handle [domain]/register and [subdomain]/register any different. We should make sure that only the former works.

Just to double-check: Should we stop resources from being served from e.g. [subdomain]/register (and other URIs that are similar to APIs) to prevent spoofing? I think that's a bit to much myself, but wanted to check with the rest.

Yes, with the exception of auth, so people can fill out their own domain.