Add user scaffold

@mdr224 @jordinl

This PR adds the user model and controller.  It sets up only necessary routes.  The login and logout routes are present but don't work yet.

We also switch over to rspec.  The security change is to enable us to use a REST console to interact with the API.

The commit history is a bit weird because we first added the rails default user scaffold and then removed the unnecessary operations.  We kept only json routes and removed all html views.  The user operations that we need are show, update, delete, login, and logout.  We don't need a create method because the login operation will not only authenticate the user but also create a new user entry if one does not yet exist using data from facebook or google.
the way to handle errors in this method is different than for not found records in application controller. I would make them consistent.

Check how rocket pants does it: https://github.com/Sutto/rocket_pants#built-in-activerecord-errors