add authorize create method on api stores controller
add spec to make sure users cannot create stores.
small typo fix
[api] add store show