Add update to controllers

This actually does quite a bit more than adding update. I realized most of our controllers had large amounts of duplicated code due to the requirements for the JSON API format, so I attempted to abstract that code out into the JsonApiController module. 

With a few differences, that I'll correct soon, this should fully reflect the published apiary api. There are couple more small things I'd like todo, namely: add specs for each JsonApiController submodule and add scopes to the link creation process. While the module should be pretty well tested by the existing controller specs, I think they should also be tested in isolation. The scopes will be necessary to prevent users from linking to otherwise private workflows and subject sets. 

This closes #147 and #135.
how is the autosave setup for relation saving? Is it automatic (can't see it on the model relation definition)? E.g. when you append / replace the relation here and in the super `relation_manager.rb#update_relation` i assume the relation is autosaved.