Add OperationOutcome formatting specs, correct authentication specs, begin work on controller specs