We have enough going on in `mkt.api.authorization` that it may be worth having a docstring on the module to inventory. And maybe rename to `mkt.api.permissions` to match DRF naming conventions.