Add update specs!

Add specs and testing for restful API controllers
The suite currently tests

- index can filter by things
- show returns the correct values
- create creates the record, and returns errors on validation, unpermited params, and unauthorized access
- update updates the record, and returns errors on validation, unpermitted params, and unauthorized access
- haven't gotten to destroy yet, but won't take that long.