Add restful API controllers

Add specs and testing for restful API controllers
again.. 
```
authorize! :show, Discussion
```
Maybe it should be in a service like the reset of the permission checks?