link-shortener: POST / with X-Auth-Token to create, GET /:code to redirect