Fix incorrect RestPack serializer usage

Closes #333 with some controller refactoring to standardize createable and updateable responses.

So the issue was the serializer `.resource` method accepts params_hash, AR scope, and context ([docs](https://github.com/RestPack/restpack_serializer/blob/8002c467ccd9596dae18a6358620f8912a0f291c/lib/restpack_serializer/serializable/resource.rb#L6)) but we were passing in the resource as the params_hash parameter. Strangely enough a resource responds to the required filter functions defined in the serializer e.g. `id`, `display_name` ([docs](https://github.com/RestPack/restpack_serializer/blob/8002c467ccd9596dae18a6358620f8912a0f291c/lib/restpack_serializer/options.rb#L50)). I don't know if this is intentional on RP's behalf, perhaps we should issue a PR checking params is a hash. 

The problem only occurred when a filter (in this case `display_name`) contains commas. As commans are used to delimit a list of filters from the URL params so the filter scope that was created was split based on the commas and thus did not match the defined project.

@brian-c - awesome bug catch. Totally outside the scope our all our unit tests and this was a system wide bug that would have come back to bite us!