Add update specs!

Add specs and testing for restful API controllers
Probably out of scope because the indexes might need to be a little more custom, but this was fun to write.

Basically we specify a list of valid filters (similar to permitted_params, which is why it went in that class), and use them to filter our results if a request comes in with those filters.

This allows us to do `/proposals?discussion_id=1` while not breaking `/proposals?discussion_id=1&utm_source="google"`