Add some permissions models to the serialisers. I'll be honest, these don't seem to have much effect except through the browsable API. Still, probably good to have them in place.
Try to limit drag'n'drop to logged-in users, but this isn't working - I think that's because the JS is being cached, and not refreshed.
Changed drag.js from being a static file to being a template. Now we edit out the drag functionality if the user doesn't have the right permissions.
That appears to work. Still need to remove the original static drag.js.