Refine 'normalize order' API endpoints

Correctly implement permissions, mostly.
Pass a dummy request to serializers when constructing ES documents

GIVEN: We need to use fully-qualifed URLs in the API.
GIVEN: Constructing fully-qualified URLs requires knowledge about the
protocol/hostname/port being used.
GIVEN: The parts of our API that list/filter/facet things come directly
from Elasticsearch. One might quibble with this design decision, but
this is where we took thing a while ago.
GIVEN: Items are indexed in Elasticsearch outside of the
request/response cycle, meaning that the protocol/hostname/port cannot
necessarily be reconstructed from a request.

So, We need to find a way to return fully-qualified URLs from serialized
objects outside of the request-response cycle.

This probably isn't the best solution, but it works right now (isn't
that always the way?). First, The base for URLs is defined in
settings_local.py. Whenever we update the Elasticsearch index with a
"document" (in the Elasticsearch sense) created from an object, we pass
that serializer a fake request built from the given protocol, hostname,
and port. This lets us continue to use existing tools (especially
rest_framework.reverse.reverse) for building fully-qualfied URLs without
having to roll our own and force serializers to know about this
ugliness.
Use fully-qualified URLs in API
Workaround for bug in django-model-utils with Django 1.5

See https://github.com/carljm/django-model-utils/pull/121

This will be unncessary once we upgrade Django.
Provide empty values for note attrs in empty serializer
Fix typo in api.urls
Don't do query templating (yet)
Fix call to get_object in api.views.project

In Django Rest Framework 2.3, get_object no longer takes a 'queryset'
argument.
Add missing pagination options to TopicNode API list