Move orchestration out of the route handlers into a service layer

Test the API-key middleware, and stop it 500ing on a non-ASCII key