Restrict access to portions of REST API to front-end deployment server only

[broadwell]

Prof. Penn has expressed interest in providing certain portions of the REST API as data resources to the larger Syriac community, so we should try to do this, but also restrict those endpoints that could be exploited or used to access restricted resources (e.g., proprietary images).