api_views.py:
- more of the same '_data' deferring for SamplePanelUpdate view
- also in SampleDetail override get() to defer '_data' and remove PermissionRequiredMixin otherwise get_object gets called and we don't avoid the _data issue