Sites

Added Site MVC
You don't actually want to permit the `user_id` here, that's not safe!  With update, for instance, you don't want me to be able to send a request with my user id to update any of the sites listed to become now associated to me.