Adding permissions to REST API

    - NOT working properly yet, see
      http://stackoverflow.com/questions/18645175/django-rest-framework-object-level-permissions
Car list POC