Make the custom viewset that checks correct updates more flexible

This change makes the fields that control ownership optional. This is
the case when not all fields are present in the request, e.g. when
PATCHing the resource.
Update the set workout set order via the API
Update the order of schedule steps via the API
Update the user's total calories via the API
Pin version of rest framework due to possible regression in 2.3.14