Add restful API controllers

Add specs and testing for restful API controllers
The show action gets covered by 
`load_and_authorize_resource only: :show,  find_by: :key`

in the restful controller, which will automagically load up the resource and call
`authorize! :show, resource` on it.