split permissions behavior across api/application_controller
remove unneeded user creation
moved api controller specs to api subdir
Merge branch 'feature/alert_when_accessing_admin' into develop