Fixes #2457: Admin auth required to modify playlist assignments (both API and page load)

Fixes #2457.

Includes new auth decorator and tests of API endpoint.
Is there a general pattern of when we raise `Unauthorized` and when we return an empty object (`[]` in this case)?