diff --git a/lib/admin/apis.js b/lib/admin/apis.js
index 3c3e54c..6c22ca0 100644
--- a/lib/admin/apis.js
+++ b/lib/admin/apis.js
@@ -38,6 +38,13 @@ module.exports.create = function (deps, conf) {
       return true;
     }
   }
+  function makeCorsHandler(methods) {
+    return function corsHandler(req, res, next) {
+      if (!handleCors(req, res, methods)) {
+        next();
+      }
+    };
+  }
 
   function isAuthorized(req, res, fn) {
     var auth = jwt.decode((req.headers.authorization||'').replace(/^bearer\s+/i, ''));
@@ -139,7 +146,10 @@ module.exports.create = function (deps, conf) {
     ;
   }
 
-  return {
+  // This object contains all of the API endpoints written before we changed how
+  // the API routing is handled. Eventually it will hopefully disappear, but for
+  // now we're focusing on the things that need changing more.
+  var oldEndPoints = {
     init: function (req, res) {
       if (handleCors(req, res, ['GET', 'POST'])) {
         return;
@@ -262,28 +272,6 @@ module.exports.create = function (deps, conf) {
         });
       });
     }
-  , config: function (req, res) {
-      if (handleCors(req, res)) {
-        return;
-      }
-      isAuthorized(req, res, function () {
-        if ('POST' !== req.method) {
-          res.setHeader('Content-Type', 'application/json;');
-          res.end(JSON.stringify(deps.recase.snakeCopy(conf)));
-          return;
-        }
-
-        jsonParser(req, res, function () {
-          console.log('config POST body', req.body);
-
-          // Since we are sending the changes to another process we don't really
-          // have a good way of seeing if it worked, so always report success
-          deps.storage.config.save(req.body);
-          res.setHeader('Content-Type', 'application/json;');
-          res.end('{"success":true}');
-        });
-      });
-    }
   , request: function (req, res) {
       if (handleCors(req, res, '*')) {
         return;
@@ -381,4 +369,38 @@ module.exports.create = function (deps, conf) {
       });
     }
   };
+
+  function handleOldApis(req, res, next) {
+    if (typeof oldEndPoints[req.params.name] === 'function') {
+      oldEndPoints[req.params.name](req, res);
+    } else {
+      next();
+    }
+  }
+
+  var config = { restful: {} };
+  config.restful.readConfig = function (req, res) {
+    res.send(deps.recase.snakeCopy(conf));
+  };
+  config.restful.saveConfig = function (req, res) {
+    console.log('config POST body', req.body);
+
+    // Since we are sending the changes to another process we don't really
+    // have a good way of seeing if it worked, so always report success
+    deps.storage.config.save(req.body);
+    res.send({ success: true });
+  };
+
+  var app = require('express')();
+
+  // Handle all of the API endpoints using the old definition style, and then we can
+  // add middleware without worrying too much about the consequences to older code.
+  app.use('/:name', handleOldApis);
+
+  app.use('/', isAuthorized, jsonParser);
+
+  app.use(   '/config', makeCorsHandler());
+  app.get(   '/config', config.restful.readConfig);
+  app.post(  '/config', config.restful.saveConfig);
+  return app;
 };
diff --git a/lib/admin/index.js b/lib/admin/index.js
index e8c146b..e317d39 100644
--- a/lib/admin/index.js
+++ b/lib/admin/index.js
@@ -15,15 +15,8 @@ module.exports.create = function (deps, conf) {
   var app = express();
 
   var apis = require('./apis').create(deps, conf);
-  function handleApis(req, res, next) {
-    if (typeof apis[req.params.name] === 'function') {
-      apis[req.params.name](req, res);
-    } else {
-      next();
-    }
-  }
-  app.use('/api/goldilocks@daplie.com/:name', handleApis);
-  app.use('/api/com.daplie.goldilocks/:name', handleApis);
+  app.use('/api/goldilocks@daplie.com', apis);
+  app.use('/api/com.daplie.goldilocks', apis);
 
   // Serve the static assets for the UI (even though it probably won't be used very
   // often since it only works on localhost domains). Note that we are using the default