None of our other endpoints have a trailing slash. Remove this inconsistency,
otherwise clients who'd not provide a trailing slash would get an unnecessary
redirect.
Note that the CORS-aware clients (web, desktop) do not automatically follow the
redirect because the ACAO is missing on the 307, so we need keep the old
endpoints around temporarily.
Tested: with web and museum running locally
7be9963303