spot controller - add basic CRUD specs & functionality

needs Admin authentication to pass create, destroy, and update specs