In app payment products api 944489

https://bugzilla.mozilla.org/show_bug.cgi?id=944489

I don't think I did the tests right. I probably tested too much and too little at the same time. Comments suggested and welcome!

Test questions:

1. Are `ViewSet`s normally tested like this? 
2. Should I test `AllowAuthor` directly?
3. If I test `AllowAuthor` directly should I ditch a bunch of the `ViewSet` tests?