audit API access and writes

- refactor api_spec to use lets
- api_access audit of GET's
- api_write audit based on model before_save hook w/sweeper