Add restful API controllers

Add specs and testing for restful API controllers
This might be a good start.. I'm not sure though. The problem as I see it is that we need to validate that a user is able to view, touch the records they are requesting. So saying an attribute name is valid is not going to do the job. And I'm not sure this pattern is going to be useful for this job.

In the case of discussions we need to use the VisibleDiscusionsQuery to ensure we only return records the user is allowed to see. It's a complex set of rules. Same with groups. I have a feeling that each controller is going to need to sanitize/process query parameters itself, with domain specific code. Ie: I think that each controller should have it's own method which reads the permitted_params and returns an active record relation for the query.