API views now authenticated with drf session auth.

I initially disabled auth because I couldn't get the auth to work.
I finally figured I needed X-CSRFToken header in my request.