Pave the way for autoreg

This PR contains some preliminary code to make autoreg possible. It allows API tokens to be granted the unrestricted ability to modify data. Because this is a bit dangerous and unproven, write privileges can only be enabled by directly setting a value in the database or the ORM.

By example:
    u = User.objects.get(id=1)  # get test_superuser
    t = Token.objects.get(user=u)
    t.can_write = True
    t.save()