This is a slight hack to get ResourceController to let me do what I needed with the master variant.
The ResourceController relies on a convention that the controller name aligns with the model name that it is modifying. However, variant is a child collection of Product, and Product.variants filters out the master variant (which we need to modify for standalone product). We need the collection returned by Product.variants_including_master, so I had to create the controller VariantsIncludingMasterController so that the resource controller will allow us to utilize that collection. 
This has the benefit of utilizing the authorization/etc code in resource controller, but does require a couple of minor tweaks to support the slightly non-standard approach.
This also required a couple of tweaks in the ResourceController to detect the appropriate model type (by falling back to the super class if the current controller class doesn't have a corresponding model).