[headless] Set up access manager before starting server
This became necessary to due an upstream change we missed when bumping the dependency.
It might be a good idea to add at least some integration tests for the API endpoints to catch things like these in tests.