Add tests for new write-only surge endpoint

- ability to create & update surge predictions
- disallow HTTP GET
- UTC datetime validity checking
- token authentication:

  * requires header: `Authorization: Token xxx`
  * token must belong to a Django user
  * Django user must have `create_surgeprediction` permission
  * HTTP 401 / 403 for header missing / forbidden

Note that we can't currently send multiple JSON records, see
https://github.com/tomchristie/django-rest-framework/issues/1965

https://www.pivotaltracker.com/story/show/80542816 [#80542816]
Implement write-only surge predictions endpoint

ie `/1/predictions/surge-levels/liverpool-gladstone-dock/`

We're using django rest framework 3.0.0 which isn't yet released, but
the serializer API is substantially rewritten so it doesn't make sense
to build on 2.4.x.