Add restful API controllers

Add specs and testing for restful API controllers
I think that's dangerous. If you authorise blindly based on discussion or group id then actions that are not permitted could slip though. Ie: if someone is allowed to show a discussion, but is not allowed to update the description, but a check for show was made, because we've gone all out on hiding the explicit, then we're not going to get a failed permission when we should, and we're not going to be told we did not check permission, because we checked the weaker one when we should only be checking for the hardest one.

I want to be really clear that I want to see explicit permissions checking happening in each controller action where there is not a service already doing it.