nail down gem versions and add shoulda_render_json
add authenticated context
force json responses. that's all we're serving