Add restful API controllers

Add specs and testing for restful API controllers
Agree on all fronts, although I think that this solution and the user permissions one can work in tandem. (since we're just chaining together queries, I think..) Also, I'd be really happy to get all this logic pushed down into a scope, so it's not in the otherwise-spanky-clean controllers.

I'm envisioning something like

`Discussion.visible_to(current_user).where(param_filters)`

`scope :visible_to, ->(user) { Queries::VisibleDiscussions.new(user: user) }`