Implement write-only surge predictions endpoint

ie `/1/predictions/surge-levels/liverpool-gladstone-dock/`

Insertions are authenticated by providing the HTTP Authorization header
with a token associated with a valid user with the correct permissions.

We're using django rest framework 3.0.0 which isn't yet released, but
the serializer API is substantially rewritten so it doesn't make sense
to build on 2.4.x.

https://www.pivotaltracker.com/story/show/80542816
https://www.pivotaltracker.com/story/show/78037278

[Delivers #80542816] [Delivers #78037278]