Bug 852965 - add secure API to look up users

* New lookup-user API
* Requires SSL
* Can look up by token or by email.
* Looking up by email requires a shared secret "auth key" to
  be included.
* Doc added to apps/news/README
* Tests added

Notes:

* This just adds a new API and does not change the behavior of any
  existing APIs, so should be safe to deploy without breaking anybody.
* If production basket is behind a proxy or load balancer, the check
  for SSL might not work right without some settings changes (see
  https://docs.djangoproject.com/en/1.5/ref/settings/#std:setting-SECURE_PROXY_SSL_HEADER)