Add user scaffold

@mdr224 @jordinl

This PR adds the user model and controller.  It sets up only necessary routes.  The login and logout routes are present but don't work yet.

We also switch over to rspec.  The security change is to enable us to use a REST console to interact with the API.

The commit history is a bit weird because we first added the rails default user scaffold and then removed the unnecessary operations.  We kept only json routes and removed all html views.  The user operations that we need are show, update, delete, login, and logout.  We don't need a create method because the login operation will not only authenticate the user but also create a new user entry if one does not yet exist using data from facebook or google.
@jordinl @mdr224 Do you think rocket pants is worth using?  It looks pretty good to use for a strictly json api.

I think that here, if the user is not found, it will still return a not found error.  `set_user` tries to set `@user` appropriately:
```ruby
@user = User.find(params[:id])
```
The `ActiveRecord::RecordNotFound` exception is raised there and triggers the appropriate response in `ApplicationController`.  The response in the `else` block above happens when the `user_params` are invalid - for instance, if the email doesn't match validation, or if a required field isn't present.  I guess to make it consistent we should add `rescue_from` blocks to `ApplicationController` for validation errors, instead of directly returning an error here.