Add user scaffold

@mdr224 @jordinl

This PR adds the user model and controller.  It sets up only necessary routes.  The login and logout routes are present but don't work yet.

We also switch over to rspec.  The security change is to enable us to use a REST console to interact with the API.

The commit history is a bit weird because we first added the rails default user scaffold and then removed the unnecessary operations.  We kept only json routes and removed all html views.  The user operations that we need are show, update, delete, login, and logout.  We don't need a create method because the login operation will not only authenticate the user but also create a new user entry if one does not yet exist using data from facebook or google.
As an API only application using controller tests isn't horrible but I would still tend to prefer using feature tests that exercise the API as an end user. Use the feature test to hit the various end points and verify the responses are what you would expect.