While we haven't got token-based auth yet, add the admin permission on API views

If we don't do this, we have a big wide open security hole in the API.

Will need to figure out a way to bring back API token authentication in a nice Pyramid-way.