Use latest Tastypie APIs

Starting with 0.9.12, Tastypie supports a new Authorization API that
supports more granular authorization checks. Functionality in many of the
``Resource``/``ModelResource`` classes also seems to be more factored
out, creating new hooks that can be used for our customizations.

Changes to our API resource and authorization classes include:

Update ``storybase.api.LoggedInAuthorization`` to use new Authorization API
instead of the old ``is_authorized`` and ``apply_authorization_limits``
methods. See
https://django-tastypie.readthedocs.org/en/latest/authorization.html#the-authorization-api

Add an authorization class, ``PublishedOwnerAuthorization`` to
encapsulate object list authorization that is repeated across
a few different resources. At some point, I think it makes the most
sense to move this into custom queryset methods implemented for each
model. This seems preferable to spreading authorization code throughout
the code base.

Move authorization checks out of ``obj_get_list`` as the kind of checks we
need are now possible in the authorization classes

Remove ``DelayedAuthorizationResource`` as the new Tastypie API now natively
offers more granular authorization checks.

Remove ``request`` as an argument from many of the resource methods as it
is no longer passed. In many cases the request is accessible via
``bundle.request``.

Update the signatures for resource class methods so that they accept
the ``bundle`` argument. ``obj_get_list`` is one example of a method where
the signature had to be updated in multiple subclasses.

Replace implementations of ``HookedModelResource`` methods with versions
that mirror the recent ``ModelResource`` implementations where, In many
cases, portions of the code have been factored out into separate methods.

Create an pass an "empty" bundle object in many of the methods of
``StoryBuilderView`` that use resource instances to output JSON to
bootstrap the Backbone views. In some cases, I had to bind the view's
request's user to the bundle's request user so that authorizaiton would
work correctly

Update signature for ``is_valid`` in our validation classes as
``Validation.is_valid`` now takes an optional ``request`` argument
Merge branch '614-latest_tastypie' into develop

This was a topic branch for updating resource and authorization classes
to use the new Tastypie APIs.
Update tastypie dependency to 0.9.15

Prior to this version, there was a weird implementation of
``RelatedField.should_full_hydrate`` that made it difficult to
use resources with related fields outside of a direct request.
In our case, this happens when we instantiate resource classes to
generate JSON to bootstrap the Backbone views in
``StoryBuilderView``.

I had previously implemented a custom field class that patched the
wonky ``should_full_hydrate`` method, but it seems best to just
require working version of Tastypie

Details about the problem and a reference to the commit that fixed
it are in the issue at
https://github.com/toastdriven/django-tastypie/issues/917