Add update to controllers

This actually does quite a bit more than adding update. I realized most of our controllers had large amounts of duplicated code due to the requirements for the JSON API format, so I attempted to abstract that code out into the JsonApiController module. 

With a few differences, that I'll correct soon, this should fully reflect the published apiary api. There are couple more small things I'd like todo, namely: add specs for each JsonApiController submodule and add scopes to the link creation process. While the module should be pretty well tested by the existing controller specs, I think they should also be tested in isolation. The scopes will be necessary to prevent users from linking to otherwise private workflows and subject sets. 

This closes #147 and #135.
do we want to expose usernames? Could be used mechanism for validating unknown usernames for use in brute force password guess / account manipulation. Especially if the user has their email as their username.