Setup HTTP routes in the Service constructors

This way the constructors have more control over which base Service
features to use: in the specific case, the admin API does not need
CSRF protection.
3 jobs for master in 1 minute and 19 seconds (queued for 1 second)
Status Job ID Name Coverage
  Build Src
passed #1241
build:src

00:00:16

 
  Build Pkg
passed #1242
build:pkg

00:00:45

 
  Upload
passed #1243
upload:pkg

00:00:18