added API login specs; updated navigational grants
more specs and controllers to the API interface