Posting to /states should be on a control-plane endpoint.

[rgangal]

I think POSTing to /states a special internal Mimic thing. So it should probably be on a control-plane endpoint, not in-line with real monitoring APIs!