use shoulda matchers for user API controller
add serializer to user for API