Initial API controller functionality.

Failing tests currently, additional models and Factories required
to support.
Generalise spec for future external use
Add example role impl and generalise specs
Add permissions model and extractable specs
Link APISubjects and Roles add further specs

More specs still to come but this shows the basic idea.