add more specs for the Api::UsersController

* not all of these pass