clean-up and minor updates
added rspec controller helper for auth bypass
updated / refactored tests
removed controllers methods no longer in use
refactored syntax to match conventions
removed unused states
add json output with PUT