Add controller documentation (first version)

I think we may use the same terminology you defined in the DS API cookbook
```
* 401: unauthorized (bad authentication)
* 403: forbidden (authenticated but not enough permissions)
```