Update to settings for rest thumbnails.
Make collections browsable by anonymous users.

Also updates to remove basic authentication from collections
so we use ApiKey, Session (django session) and Anonymous.