started testing of api object, added serializer tests

deserialize() is more robust in the face of bad data and invalid content
types