Add restful API controllers

Add specs and testing for restful API controllers
I'm pretty dangerously close to writing a before_filter on the index action (maybe all actions) which checks for the presence of :discussion_id / :group_id in the params and authorizes them. Then we'd have to explicitly say skip_before_filter :authorize_discussion if we want to override that.