Fix user_api_path

Ensures user_api_path has leading slash.
Locks rspec to currently supported version, preparing for move to 3.0
Add path_prefix specs.
Verifies via authorize_url (vs. config value)