Add controller test for GameState, and restrict controller actions.
Default API to JSON format.