Fixes #2457: Admin auth required to modify playlist assignments (both API and page load)

Fixes #2457.

Includes new auth decorator and tests of API endpoint.
This is a decorator that can be used on tastypie's `Resource.obj_*` methods, to restrict access. Likely of particular interest to @rtibbles, @aronasorman, and @dylanjbarth.