Add update specs!

Add specs and testing for restful API controllers
This is a bit opinionated and inherited resources-y, but I think it's super clean and tough to break, while allowing us to extend custom functionality where necessary.