Add authentication and model permission checking to REST API.

I used `DjangoModelPermissionsOrAnonReadOnly`, which allows us to define permissions for users or groups in the django admin.

@ormsbee