Add operator shelf authorization, apply to relevant viewset, add command line tools for permissions management.

See the testing spec in the bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1074304#c1

r? @robhudson @ngokevin @diox
https://docs.djangoproject.com/en/dev/topics/db/optimization/#don-t-overuse-count-and-exists

As I understand it, `len` forces the evaluation of the queryset, which I can then use later if I need to. `.exists()` would make a query and return a boolean, and I would then need to run a second query later. Do I have that wrong?