add rspec and controller tests, add controller to accept api_key
fix merge