audit API access and writes

TODO:
- do another pass at clean up. 
- investigate why notifications take forever in api_spec.rb

- refactor api_spec to use lets
- api_access audit of GET's
- api_write audit based on model before_save hook w/sweeper