@wip Add specs and authentication

This will be squashed with the previous commit once we agree.
I have added a test and (for now) removed .id and .display_name
from ContentOwner, in order to first check if tests are passing
just for the `has_many :content_owners` association.

What do you think @stavro ?