Add settings to user profile, hidden behind auth..

The user settings API works very much like the questions metadata API. And I discovered that the questions metadata API is broken. I fixed the question metadata API, kind of. I implemented the user settings API the same way. I hid the settings API with a new field I made that hides it uniless certain conditions are met. In this case I check for a logged in user that matches the user being queried. I also put email address in a field like that too.

I'm really not satisfied with how DRF and our metadata-like models interact. I'm not sure what to do about that. I tried making a field/serializer thing that acted like a dictionary, but couldn't get it to work.

@willkg I'm curious what you think about the PermissionsMod class. It's the field decorator we talked about that implements the permission fields.

r?
Yeah, this is the decorator way to make read/write properties. The other way would be

```python
def write_only_getter(self):
    ...

def write_only_setter(self, val):
    ...

property(write_only_getter, write_only_setter)
```

The names mean nothing (except for `property`).