Add permissions for API views

There are two new viewsets, which inherit from ModelViewSet
  - OTIAdminViewSet
  - OTIBaseViewSet

This allows the settings/configuration views to be read-only for regular
users, and editable by admin, which is defined as having
is_staff == True

Default permissions are full access for regular users,
must be authenticated