Add support for protecting a resource by user or session

This introduces two resource properties `user_support` and `session_support`
which change the behavior of `get_queryset` (which all queries go through)
to limit results based on the user or session key of the request.

If either property is None, the resource will be checked for the `user`
and `session_key`, respectively, to determine if support should be enabled.
Either property can be explicitly False to disable the behavior.