api_views.py:
- modify all the GET api views to use the new project and site permissions...still need to do the PUT/PATCH ones

models.py:
- in get_projects_user_can_view(): don't use list(chain()), need to return a queryset for django-rest-framework views to work
- in get_sites_user_can_view(): make project argument optional, return all sites in all projects for the user if project not specified
- add has_view_permission() method to Panel, Subject, ProjectVisitType, and Compensation Models
- BUGFIX: in Sample model method has_view_permission(), check the object based perms not the class based ones

serializers.py:
- add site field to CompensationSerializer

views.py:
- update views using get_sites_user_can_view() to add 'project=' for optional arg