Add update specs!

Add specs and testing for restful API controllers
We assume that the services will handle the authorization here, so no auth necessary.