api: convenience wrapper for challenge
authz: add AuthzDjangoAnonRead which allows anonymous users to read only