Add authentication and access control for API requests

The following rules apply:
* User and company info can only be accessed by logged in user
* The current user can only access his/her own personal or company-wide info
Patch a bug in Flask-Admin==1.0.6

flask_admin.form.TimeField missing 'formats' attribute