Feature/auth permissions

Note that this MR will break the angular app gtfs upload page until we implement token auth client side.

Also requires a DROP DATABASE transit_indicators and a re-provision. 

See commit comments for further info.