Purchases controller spits back JSON