Fixes #151

Makes all MAC address range operations admin-only. Additionally, moves
the one admin-only check in the API extension into the plugin module to
make it more easily testable.

Finally, moves a brace in nvp_driver because the latest version of
flake8 after a venv rebuild inexplicably decided said brace was visually
indented incorrectly. We should probably pin the flake8 version, but we
can do that in a separate patch.