Fixes #2457: Admin auth required to modify playlist assignments (both API and page load)

Fixes #2457.

Includes new auth decorator and tests of API endpoint.
So there's a bug in here when playlist_id == 0, I guess. Could you put in an inline comment with your rationale why you went with this idiom? Thanks.