Controller piece should be API

[payne-chris-r]

Hey @MattB-GA-Boston, can you explain what you meant in the table:
Location: Controller
Pro: Within the app, so it can't be circumvented. In Ruby, so it's independent of our DB choice.
Con: Difficult to test and maintain. Controllers should be sparse!

@jrhorn424 suggested this might be better as "API" because it should probably be in the Model, not the Controller, but more insight would be helpful.