Review and cleanup of JSON API

Removed JSON from classes that shouldn't have it.
(PT: https://www.pivotaltracker.com/story/show/54570954)

Also found a couple of controllers with broken authorization (i.e. not
checking CanCan). Incidentally, this also fixes the comment form bug at
https://www.pivotaltracker.com/story/show/54328716.