Fix failing specs

This mostly a matter of them specing against changed controller behavior
(now standard server-side RESTful stuff), not anything that was broken.