Add tests for new write-only surge endpoint

- ability to create & update surge predictions
- disallow HTTP GET
- UTC datetime validity checking
- failure in 1 record aborts write of *all* records in that request
- token authentication:

  * requires header: `Authorization: Token xxx`
  * token must belong to a Django user
  * Django user must have `create_surgeprediction` permission
  * HTTP 401 / 403 for header missing / forbidden

Note that we currently implement our own (inefficient) bulk-save. See
https://github.com/tomchristie/django-rest-framework/issues/1965

https://www.pivotaltracker.com/story/show/80542816 [#80542816]
Implement write-only surge predictions endpoint

ie `/1/predictions/surge-levels/liverpool-gladstone-dock/`

Insertions are authenticated by providing the HTTP Authorization header
with a token associated with a valid user with the correct permissions.

We're using django rest framework 3.0.0 which isn't yet released, but
the serializer API is substantially rewritten so it doesn't make sense
to build on 2.4.x.

https://www.pivotaltracker.com/story/show/80542816
https://www.pivotaltracker.com/story/show/78037278

[Delivers #80542816] [Delivers #78037278]