Workflow controller

Just for sanity checking, could I get another set of eyes on this?  I tried to conform to styles/patterns already established, but it's worth verifying.
It's kind of backing into authorization, but I don't think we really need to worry about that.  I guess if you wanted to prevent people from crawling the API then maybe we could do that.  My intent was simply to ensure no malicious users from modifying others' data