Fixed broken regular expressions in urls.py

The URL definitions in `tncapp/urls.py` contained some broken regular
expressions (missing trailing slash). This commit fixes these.
Check permissions in backend

Added `@permission_required` checks in all relevant views.

There is now a new test function in `tests/test_auth.py` that verifies
permissions on all the relevant URLs. If new create/update/delete URLs
are added, the test parameters should be adjusted accordingly.