Support for specificying capabilities in the endpoints.

Also we send the "Allow" header taking into account the capabilities and the current user
Fixed header name Allowed -> Allow
Return a 403 if the user is not authorized, not 401
Add helper methods to the json server spy class so we can capture and retreive sent headers
New unit tests for capability checks and allow header sending checks
Merge branch 'develop' into capabiltity
Move the sending Allow header out of Dispatch

I had to make the send_header() method public on the server class - which I don't think is a bad thing.
Pull the regex matching into a seperate funtion as having the duplication is doing my head in!
Set the headers on the Response object

This means we can get rid of the spy methods too
Cold feet on removing the slightly more performant foreach in dispatch()
Move setting matched route / handler on the response object so we don't have to dig for it twice
Update to use new methods on response object, more performance
Merge branch 'develop' into capabiltity

Conflicts:
	tests/test-json-server.php
Removed unneed spy class codez
Whitespace fix
ID shouldn't be a param on update user endpoint
Merge pull request #692 from WP-API/fix-id-user-controller

ID shouldn't be a param on update user endpoint
Failing tests for query args
Transform `tag` into `post_tag` for cleaner endpoints
Fix tests - we're forgetting `filter` ever existed