use a buffer for the log instead of an unbound list, move the endpoint into /api/util for simplicity and limit it to superuser access.

continue including the source because it turns out we are using it as part of some of our classpath searching code.