Switched to custom API permission class

Access to the API is granted in two cases:

- User is an admin (`is_staff=True`)
- User has the `auth.write_access` permission

Otherwise, the user is rejected with a HTTP 401 or HTTP 403 status.
Added CSRF_COOKIE_SECURE to settings.ini
Enabled clickjacking protection