Bug 852965 - add secure API to look up users

* New lookup-user API
* Requires SSL
* Can look up by token or by email.
* Looking up by email requires a shared secret "API key" to be included.
* Doc added to README.rst
* Tests added

Notes:

* This just adds a new API and does not change the behavior of any existing APIs, so should be safe to deploy without breaking anybody.
* If production basket is behind a proxy or load balancer, the check for SSL might not work right without some settings changes (see https://docs.djangoproject.com/en/1.5/ref/settings/#std:setting-SECURE_PROXY_SSL_HEADER)