Fix: don't use django auth for permissions, just require authentication

(Prior to this, only admins could write to the API.)