Store user that created stream on stream object

Later we can use this to make sure only this user has access to
edit/delete the stream.
Add creator_id migration for streams
Restrict access to editing streams to creator

Also add `login_required` decorator to refuse all requests without an
auth_token.
Use HTTP Authorization headers for auth

This replaces the auth_token param as the primary means of authentication.
The change was done since you can't pass params to a DELETE request, and
it's a bit ambivalent whether it's valid HTTP. This is cleaner and more
compliant, and uses the 'Token' type of authorization.
Restrict stream deletion to the user who created it
Restrict user details to logged in users

Users can still only access their own data, but now we return a HTTP 401
for requests without an authorization header, instead of a 403.
Update docs with info on access to streams
Delint

Added some missing docstrings and ignored a couple of warnings in test.