Breaking up Viewsets for Car and Treatments and improving coverage

    - More flexibility to choose serializers, permissions, filters, etc
    - Car views that returned 404 when the request didn't
      came from the owner, now return a more clear 403. This is worse
      security wise as indicates that the resource exists, but it's less
      bug prone since it now indicates exactly what the problem is.
    - Also, Greatly improved coverage for Treatment API views