Added `related_name` to specify the name of the reverse relation.
Updated the representation of the image model.
Updated serializer classes.

1. Moved `ReviewSerializer` in front of `ProductSerializer` to implement nested relationships.

2. `ReviewSerializer`: Removed the fields `id`, `product`to simplify the nested infomation.

3. Added `UserSerializer` for authentication & permissions.
Refactor - the endpoints are logically organized around collections and elements.
Added or updated the comments.
Added a couple of views.

We'd like to just use read-only views for the user representations, so we'll use the `ListAPIView` and `RetrieveAPIView` generic class based views.

REF: [Django REST Framework Tutorial 4: Authentication & Permissions](http://www.django-rest-framework.org/tutorial/4-authentication-and-permissions)