Add update specs!

Add specs and testing for restful API controllers
Some of the resources require the author of the resource be set on create, which leads to ugliness like

```
@discussion = Discussion.new permitted_params
@discussion.author = current_user
```

I'm a little blerg about this line, but there's not a case out there where it doesn't work. I'm probably going to restrain it to just create, though. (If you're submitting a thing for creation, it's pretty safe to assume you're the author)