Use dedicated private environment

There has to be a way to define an environment in server.r's scope that api.r can find that isn't the global environment. It's not a huge problem, but there's no reason that there should be any opportunity for scripts that get sourced to override objects in the environment that we may need.