no need to allow create via API

that always goes through the Twitter OAuth flow
enable debugging in specs
DB wasn't actually being cleaned between specs
we probably don't want to allow user delete through API either
users can only edit their own streets
users can only edit their own records and destroy their own API auth tokens
controller specs: clear out @current_user after each
trying to clarify the behavior for /api/v2/streets?namespacedId=x

TOOD: figure this out
adding some controller specs

test coverage now up to 81.69% !