Tests added for api calls to support private bookmarks

I think this part should be pulled into a function as I think we'll need to use it more than once. 

    if request.user and not bookmark.has_access(request.user.username):
        bookmark = None

So this would require adding a has_access method to the Bmark class that would accept a username and check it against the current user. It might as well also do the private check as well. 

Then the code would read just as

    if bookmark and not bookmark.has_access(request.user.username):
        bookmark = None