This really applies only to RaspiBlitz. Depending on the current
setup step there still isn't a Bitcoin Deamon or Lightning Node running.
We must defer the registration of all those handlers until later when
everything is properly setup.
Since there is a final reboot after the setup there is no need to
check in the background whether setup is finished. The API server
is restartet anyway.
refs #71
* password_a must now be posted in the request body as a json object
* password is now read from the .env file instead of hardcoded
* password will be checked if it is min 8 chars
* one_time_password is not yet in use and optional