make user api work with basic auth

Django_rest_framework's viewsets.ReadOnlyModelViewSet has a default authentication scheme that uses both session and basic auth.   We use neither, but the presence of basic auth credentials in the http request "wakes up" the basic auth check and causes requests to fail with 401s (even when the correct api key is presented).  Removing basic auth from the ViewSets solves this.