[headless] Set up access manager before starting server

This became necessary to due an upstream change we missed when bumping the dependency.

It might be a good idea to add at least some integration tests for the API endpoints to catch things like these in tests.