Add restful API controllers

Add specs and testing for restful API controllers
This was the first case I found where we needed to have some custom controller functionality beyond regular restful-y stuff. I think it's pretty simple and readable, although the `param_filters[]` and `param_filters.except` thing might not be perfect.